document-generate

An agent skill by garrytan, from garrytan/gstack. Tags: automation, documentation, writing.

What it does

Generate missing documentation from scratch for a feature, module, or entire project. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill document-generate

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/document-generate ~/.claude/skills/document-generate

Safety box score

Grade D, elevated risk: 54 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill generates docs, edits repo files, and then can commit, push, and update a pull request body on the user's authenticated git host. The main risks are outbound network actions on the user's account, broad shell execution through local helper scripts, and hidden behavior in the bundled gstack commands it calls.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It is a Bash-driven workflow that runs commands like `~/.claude/skills/gstack/bin/gstack-skill-start`, `find`, `git commit`, and `git push`.
Network access	2 (moderate)	It talks to remote git hosts via `gh`, `glab`, and `git push`, and it can update a PR body on GitHub/GitLab.
Filesystem reach	2 (moderate)	It reads the repo broadly and writes docs plus files outside the project such as `.gstack/tmp/qt.txt`, `~/.gstack/`, and `$GSTACK_STATE_ROOT/analytics/`.
Secrets & credentials	1 (low)	It queries CLI auth state with `gh auth status` / `glab auth status` and includes a staged-doc redaction scan to block live-format secrets before commit.
Privilege & persistence	0 (none)	There is no sudo, service registration, global install, or shell-startup mutation in the skill text.
Instruction hijack surface	2 (moderate)	It tells the agent to "Treat the skill file as executable instructions" and to honor `GSTACK_INSTRUCTION_BEGIN` blocks from tool output, which is a prompt-injection surface.
Irreversible actions	3 (high)	The workflow explicitly performs outward actions like `git commit`, `git push`, and PR body updates, which publish changes on the user's behalf.
Transparency	2 (moderate)	The skill depends on local helper scripts under `~/.claude/skills/gstack/bin/` whose implementations are not included in the visible source.

Before installing

Read the helper scripts in `~/.claude/skills/gstack/bin/` if you can; they are part of the real behavior, not just names in the workflow.
Run it once in a throwaway branch and verify whether `git push` and PR-body updates happen automatically in your setup.
Check the paths under `~/.gstack/` and `.gstack/tmp/` to confirm you are comfortable with writes outside the repo.
Make sure the staged-doc redaction scan catches the kinds of secrets you care about before trusting it to publish docs.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: document-generate/SKILL.md
Branch: main
Updated: 2026-10-05

automate-me — Use for "automate me", "create/update/refresh my -mode skill", "turn/capture my preferences or working style into a skill".
continual-learning — Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to `agents-memory-updater`.
copy-editing — When the user wants to edit, review, or improve existing marketing copy, or refresh outdated content.
goal-prompt — Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex.
google-docs — Author and edit Google Docs with the google-docs tools - structured writing, character and paragraph styling, lists, tables, images, headers/footers.
teach — Explain a body of work plainly so a person actually understands it. Runs the `how` and `why` skills and weaves what they find into one clear explanation.