document-release

An agent skill by garrytan, from garrytan/gstack. Tags: documentation, release-management, review.

What it does

Release documentation audit. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill document-release

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/document-release ~/.claude/skills/document-release

Safety box score

Grade F, high risk: 82 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a documentation release driver: it reads diffs, rewrites repo docs, can bump versions, commit, push, and update PR/MR bodies and titles. The main risks are remote publication, external Codex review that can send repo content off-machine, and instruction-heavy behavior that can override normal agent caution.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It runs a long chain of shell commands and helpers, including `~/.claude/skills/gstack/bin/gstack-skill-start`, `git commit`, `git push`, and `codex exec`, so it can execute substantial shell workflows.
Network access	3 (high)	It publishes changes remotely with `git push` and PR/MR edits, and the Codex doc review path can send repository content and diffs to an outside service.
Filesystem reach	2 (moderate)	It writes outside the repo to home-state locations like `~/.claude/skills/gstack/...` and `~/.gstack/...`, and deletes a temp tree with `trap 'rm -rf "$ _OUTSIDE_TMP"' EXIT`, but does not target broad system paths.
Secrets & credentials	2 (moderate)	It relies on authenticated `gh`, `glab`, and Codex flows, and explicitly mentions `codex login` and `$CODEX_API_KEY`, so it can operate under and expose data through the user's logged-in accounts.
Privilege & persistence	2 (moderate)	It can install tooling globally with `npm install -g @openai/codex` and mutates user-level gstack config/state, but it does not request sudo or service registration.
Instruction hijack surface	3 (high)	It tells the agent to treat the skill file as executable instructions, honor `GSTACK_INSTRUCTION` blocks from tool output, and auto-choose recommended options in spawned sessions.
Irreversible actions	3 (high)	Its purpose includes editing docs, committing, pushing, updating PR/MR bodies and titles, and optionally bumping VERSION, so it can publish changes with minimal human intervention.
Transparency	2 (moderate)	A lot of behavior is delegated to external helpers under `~/.claude/skills/gstack/bin/` and `bun run ...`, which are not included in the shipped files and cannot be inspected here.

Before installing

Read `sections/release-body.md` around the Codex review and PR update steps if you do not want docs sent to an external reviewer.
Confirm whether you are comfortable with a tool that can `git commit`, `git push`, and edit PR/MR body/title text on your behalf.
Check that `gh`/`glab` auth is scoped the way you expect, and that `codex_reviews` is enabled or disabled on purpose.
If you do not want home-directory state touched, inspect the `~/.claude/` and `~/.gstack/` helper calls first.

Rated 2026-10-16 by an automated review of 4 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: document-release/SKILL.md
Branch: main
Updated: 2026-10-05

analyzing-release-readiness — Trigger a pre-merge release readiness review on a GitHub PR, GitLab MR, or local branch.
copy-editing — When the user wants to edit, review, or improve existing marketing copy, or refresh outdated content.
get-pr-comments — Fetch and summarize review comments from the active pull request
make-pr-easy-to-review — Prepare PRs for review by cleaning noisy history, improving PR descriptions, and adding reviewer guidance without changing code behavior.
principle-minimize-reader-load — Apply when reviewing or shaping code that's hard to trace.
review-walkthrough — Generates an interactive HTML walkthrough for reviewing code changes. Use only when explicitly called.