benchmark

An agent skill by garrytan, from garrytan/gstack. Tags: evaluation, performance, testing.

What it does

Performance regression detection. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill benchmark

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/benchmark ~/.claude/skills/benchmark

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill measures web performance by opening live pages in a browser, reading performance entries, and writing benchmark reports and baselines. The main risks are network access to arbitrary sites, use of the user’s authenticated browser session when present, and persistent writes into hidden `.gstack` state/report directories.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs shell commands and page-context JavaScript (`gstack-skill-start`, `git update-index --refresh`, `aside repl`, `$B js`, `pg.evaluate(...)`) as part of the benchmark workflow.
Network access	2 (moderate)	It opens real URLs and loads their resources for measurement, and it may also download helper tooling such as Aside or bun via the setup path (`Download Aside...`, `./setup`).
Filesystem reach	2 (moderate)	It writes benchmark reports and baselines under `.gstack/benchmark-reports/` and telemetry under `$GSTACK_STATE_ROOT/analytics/`, which are persistent hidden directories.
Secrets & credentials	2 (moderate)	The browser flow can use the user’s signed-in session and explicitly mentions `/setup-browser-cookies` importing real-browser cookies, so it can operate on authenticated accounts.
Privilege & persistence	1 (low)	It does not use sudo or services, but it can trigger a local user-space install/build step (`./setup`, which installs bun when missing).
Instruction hijack surface	1 (low)	It tells the agent to follow `GSTACK_INSTRUCTION_BEGIN` blocks from `gstack-skill-start`, but constrains them to the exact tool result and session, which is controlled rather than open-ended.
Irreversible actions	0 (none)	The stated purpose is read-only benchmarking and report generation; it does not post, pay, book, deploy, or delete anything.
Transparency	2 (moderate)	Key behavior depends on unreadable native scripts/binaries invoked by path (`~/.claude/skills/gstack/bin/gstack-*`, `browse/dist/browse`), so a reviewer cannot inspect those implementations here.

Before installing

Read the bundled native helpers the skill calls: `~/.claude/skills/gstack/bin/gstack-skill-start`, `gstack-skill-end`, `gstack-browser-ensure`, and `./setup` if present.
Confirm `./setup` only installs user-space dependencies and does not edit shell startup files or system locations.
Check where `.gstack/benchmark-reports/` and `$GSTACK_STATE_ROOT/analytics/` resolve on your machine so you know what will persist.
If you may benchmark authenticated pages, verify which browser session/account will be used before running it.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: benchmark/SKILL.md
Branch: main
Updated: 2026-10-05

llm-eval-harness — Test/evaluate any LLM behind an OpenAI- or Anthropic-compatible endpoint: availability (max_tokens-aware).
test-master — Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures.
ab-testing — When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program.
agents-optimize — Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI/CD quality gates, observability, or cost optimization.
coverage-analysis — Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output.
seo-unlighthouse — Multi-page Lighthouse audit via the MIT-licensed Unlighthouse CLI.