canary

An agent skill by garrytan, from garrytan/gstack. Tags: deployment, monitoring, validation.

What it does

Post-deploy canary monitoring. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill canary

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/canary ~/.claude/skills/canary

Safety box score

Grade F, high risk: 67 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a live-production canary monitor: it opens the target site in a browser, checks console errors, HEAD-fetches same-origin links, captures screenshots, and writes reports under `.gstack/` plus local telemetry/history. The main risks are real-session browser access, many delegated local helper scripts, and instruction blocks that can steer the agent based on tool output.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs shell commands and embedded browser JS, including `~/.claude/skills/gstack/bin/gstack-skill-start`, `aside repl`, and `gstack-skill-end`, so it is active automation rather than a static doc.
Network access	2 (moderate)	It talks to live production URLs, HEAD-fetches links, and may download/setup browser tooling (`Download Aside ...`, `./setup` / `/gstack-upgrade`), so it has real outbound network reach.
Filesystem reach	2 (moderate)	It writes screenshots and manifests to `.gstack/canary-reports/` and appends history under `$GSTACK_STATE_ROOT/projects/$SLUG/canary-history.jsonl`, which reaches into hidden home and state directories.
Secrets & credentials	2 (moderate)	It can use logged-in browser sessions and explicitly mentions `/setup-browser-cookies` that "imports real-browser cookies", so it can access authenticated pages with the user's existing session.
Privilege & persistence	1 (low)	It does not require sudo, services, or global installs in the normal flow; the only privileged-looking actions are optional local setup/update steps like `./setup` or `/gstack-upgrade`.
Instruction hijack surface	3 (high)	It tells the agent to treat the skill file as executable instructions and to follow `GSTACK_INSTRUCTION_BEGIN` blocks from tool output, plus auto-choose in spawned/unattended sessions, which creates a strong prompt-injection surface.
Irreversible actions	2 (moderate)	Its purpose is to run continuous post-deploy monitoring, compare against baselines, and present rollback/update-baseline choices; it touches production pages but does not itself deploy or mutate remote systems.
Transparency	2 (moderate)	Core behavior depends on local helper binaries under `~/.claude/skills/gstack/bin` and browser tooling outside this file, so a reviewer cannot fully audit runtime behavior from the SKILL.md alone.

Before installing

Read `~/.claude/skills/gstack/bin/gstack-skill-start` and `gstack-skill-end` to confirm what telemetry or local state they touch.
Decide whether you want this skill to access authenticated pages via existing browser cookies or only unauthenticated URLs.
Run it first against a staging or localhost URL and check that all writes stay under `.gstack/canary-reports/` and `$GSTACK_STATE_ROOT`.
Confirm who is allowed to act on alerts like rollback or baseline updates, since the skill will prompt for those decisions on real production pages.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: canary/SKILL.md
Branch: main
Updated: 2026-10-05

seo-drift — SEO drift monitoring: capture baselines of SEO-critical elements, detect changes, and track regressions over time.
eas-update-insights — EAS service (paid). Check the health of published EAS Update: crash rates, install/launch counts, unique users, payload size.
use-railway — Operate Railway infrastructure: sign up for or sign in to a Railway account, create projects, provision services, databases, and buckets, deploy code.
review — Pre-landing PR review. (gstack)
creating-api-gateway-stage — Creates an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling, WAF integration, and IAM roles following AWS best practices.
debugging-network-issues — Investigates network, streaming, and protocol failures with falsification-first layered experiments.