health

An agent skill by garrytan, from garrytan/gstack. Tags: analysis, code-quality, dashboard.

What it does

Code quality dashboard. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill health

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/health ~/.claude/skills/health

Safety box score

Grade D, elevated risk: 46 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a code-health dashboard skill: it shells out to the repo's typecheck, lint, test, dead-code, and shell-lint tools, then persists history and telemetry under `~/.gstack` and can update `CLAUDE.md` if the user opts in. The main risks are arbitrary repo code execution through those tools, broad local state writes, and a strong runtime-instruction surface that can steer the agent's behavior.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly runs project tools like `tsc --noEmit`, `biome check .`, `bun test`, `knip`, and `shellcheck`, so installing it grants execution of the repo's own commands and whatever those scripts invoke.
Network access	0 (none)	The reviewed file does not fetch remote content or send data to external hosts; the named side effects are local logs, history, and telemetry under `~/.gstack`.
Filesystem reach	2 (moderate)	It reads project and home config, can append/update `CLAUDE.md`, and writes health history and telemetry under `~/.gstack/projects/$SLUG/health-history.jsonl` and `$GSTACK_STATE_ROOT/analytics/`.
Secrets & credentials	0 (none)	There is no explicit access to tokens, keychains, browser sessions, `.env` files, or other credential stores in the skill text; the session-cookie line is just an example in prose.
Privilege & persistence	1 (low)	It can modify repo and user-state files such as `CLAUDE.md` and `~/.gstack`, but it does not ask for sudo, global installs, services, scheduled tasks, or shell/OS setting changes.
Instruction hijack surface	3 (high)	It tells the agent to treat the skill file as executable instructions, honor `GSTACK_INSTRUCTION_BEGIN` blocks from tool output, and auto-choose options in spawned/unattended sessions, which is a direct instruction channel into the agent.
Irreversible actions	0 (none)	The skill does not push, publish, deploy, pay, book, delete, or send messages; it only runs local checks and optionally persists local state after user choice.
Transparency	2 (moderate)	Core behavior depends on local scripts like `~/.claude/skills/gstack/bin/gstack-skill-start` and `gstack-skill-end`, but those implementations are not included in the provided source, so a reviewer cannot fully audit the real side effects.

Before installing

Inspect the local `~/.claude/skills/gstack/bin/*` scripts this skill calls, especially `gstack-skill-start` and `gstack-skill-end`.
Decide whether you're okay with it writing `CLAUDE.md` and `~/.gstack/projects/<slug>/health-history.jsonl` before you let an agent run it.
Run it once in a scratch repo, because it will execute the repo's own test/lint commands and may run package scripts.
If you don't want agent auto-decisions, review the spawned/unattended session logic and the `GSTACK_INSTRUCTION` block handling first.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: health/SKILL.md
Branch: main
Updated: 2026-10-05

audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
code-maturity-assessor — Systematic code maturity assessment using Trail of Bits' 9-category framework.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
differential-review — Performs security-focused differential review of code changes.