gstack-upgrade

An agent skill by garrytan, from garrytan/gstack. Tags: automation, deployment, setup.

What it does

Upgrade gstack to the latest version.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill gstack-upgrade

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/gstack-upgrade ~/.claude/skills/gstack-upgrade

Safety box score

Grade D, elevated risk: 65 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill upgrades gstack by fetching remote code, replacing the local install, running migrations, and pruning stale state under the user's home directory. The main risks are destructive rollback/reset behavior, authenticated GitHub/GitLab repo changes, and runtime execution of externally fetched installers during the upgrade.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It runs shell commands and external installers, including `git pull --ff-only`, `git reset --hard origin/main`, and `bunx playwright install chromium`, so the agent can execute code fetched during the upgrade.
Network access	3 (high)	It downloads from and talks to remote services with `git fetch origin`, `git clone --depth 1 https://github.com/garrytan/gstack.git`, `gh repo rename`, and `bunx playwright install chromium`, so upgrade traffic leaves the machine and pulls in remote content.
Filesystem reach	3 (high)	It writes and deletes in the user's home tree and can recursively remove installs or caches, e.g. `rm -rf "$INSTALL_DIR"`, `rm -rf "${rev_dir}"`, and `rm -rf "$LOCAL_GSTACK"`.
Secrets & credentials	2 (moderate)	It operates through authenticated account state (`gh auth status`, `glab auth status`) and edits home-state/config files like `~/.claude`, `~/.gstack`, and `~/.gbrain`, so it can act with the person's logged-in credentials and stored settings.
Privilege & persistence	0 (none)	There is no `sudo`, service registration, global package install, or shell/OS startup-file editing in the shipped scripts.
Instruction hijack surface	1 (low)	The skill tells the agent to skip prompts and proceed automatically in some modes, e.g. `Skip AskUserQuestion` when auto-upgrade is enabled and `Proceed directly to Step 2`, but it does not fetch or follow untrusted prompt text.
Irreversible actions	3 (high)	Its purpose is to make changes automatically, including replacing the install, deleting stale copies, stopping daemons, and in migrations renaming remote repos or sources with `--yes`/`--ff-only` behavior.
Transparency	2 (moderate)	The bundle is readable, but it triggers unpinned runtime-fetched content such as `git clone --depth 1 https://github.com/garrytan/gstack.git` and `bunx playwright install chromium`, which a static reviewer cannot inspect from these files.

Before installing

Read `SKILL.md` Step 4 and confirm you accept `git reset --hard`/replacement of the install.
Check whether `gh` or `glab` are authenticated, since a migration can rename a remote repo.
If you rely on a vendored copy or Playwright cache, expect recursive deletes under `~/.claude/skills/gstack`, `~/.claude/skills/gstack.bak`, or `~/Library/Caches/ms-playwright`.
Run it once in a scratch account/profile if you do not want your home-state files under `~/.gstack` and `~/.claude` touched.

Rated 2026-10-16 by an automated review of 17 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: gstack-upgrade/SKILL.md
Branch: main
Updated: 2026-10-05

agents-deploy — Use when deploying your agent to AWS, or when a deploy has failed.
eas-workflows — EAS service (paid). Helps understand and write EAS workflow YAML files for Expo projects.
principle-build-the-lever — Apply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks.
setup — Set up the AWS DevOps Agent and AWS Security Agent connections. Use when the user says "set up", "configure", "connect", or when MCP tools are missing.
setup-benny — Configure Benny and prepare its triage and repro automations.
setup-security-agent — Configure AWS Security Agent for the current workspace — provision or reuse an agent space, IAM service role, and S3 bucket.