hackernews-frontpage

An agent skill by garrytan, from garrytan/gstack. Tags: analytics, scraping, web.

What it does

Scrape the Hacker News front page (titles, points, comment counts).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill hackernews-frontpage

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/browser-skills/hackernews-frontpage ~/.claude/skills/hackernews-frontpage

Safety box score

Grade B, low risk: 25 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only Hacker News scraper: it opens `https://news.ycombinator.com/`, reads HTML through the browser daemon, and prints parsed stories as JSON. The main risks are network access to a remote site and the client’s fallback path that can read a local `.gstack/browse.json` token file when run outside the harness.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It runs its own TypeScript and also shells out to `git rev-parse --show-toplevel` in `_lib/browse-client.ts`, but there is no arbitrary code evaluation or downloaded code execution.
Network access	2 (moderate)	`script.ts` navigates to `https://news.ycombinator.com/`, and `_lib/browse-client.ts` sends POSTs to `http://127.0.0.1:<port>/command`, so it does reach both an external site and a local daemon.
Filesystem reach	1 (low)	The skill reads local files, including the bundled fixture in `script.test.ts` and the fallback state file `<git-root>/.gstack/browse.json`, but it does not write or delete files.
Secrets & credentials	2 (moderate)	`_lib/browse-client.ts` can load a daemon token from `.gstack/browse.json` (`data.token`) if run directly, so it touches a credential store even though the normal harness uses scoped env vars.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or other privilege-changing behavior.
Instruction hijack surface	0 (none)	The files do not instruct the agent to ignore rules, hide behavior, or follow remote instructions.
Irreversible actions	0 (none)	Its stated purpose is to scrape and return JSON; it does not post, buy, deploy, delete, or otherwise take external actions.
Transparency	0 (none)	All shipped files are readable source/text; there are no binaries, base64 blobs, or hidden runtime-decoded code.

Before installing

Read `_lib/browse-client.ts` and confirm you are comfortable with the `.gstack/browse.json` fallback token path.
Run it once in a scratch checkout and verify it only reaches `news.ycombinator.com` and `127.0.0.1`.
Check whether your environment exposes a real `.gstack/browse.json`; if so, assume the skill can read that token when launched directly.

Rated 2026-10-16 by an automated review of 5 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: browser-skills/hackernews-frontpage/SKILL.md
Branch: main
Updated: 2026-10-05

cro — When the user wants to optimize, improve, or increase conversions on any marketing page or form — including homepage, landing pages, pricing pages.
popups — When the user wants to create or optimize popups, modals, overlays, slide-ins, or banners for conversion purposes.
seo-firecrawl — Full-site crawling, scraping, and site mapping via Firecrawl MCP.
scrape — Pull data from a web page through the Aside browser — your real, already signed-in sessions. (gstack)
bilibili-source — Fetch comprehensive, login-free data for any Bilibili (B站) video — title, UP name and follower count, publish date, partition, tags, per-part cids.
scrapling-skill — Install, troubleshoot, and use Scrapling CLI to extract HTML, Markdown, or text from webpages.