Skills Explorer Add Skills

ios-clean

An agent skill by garrytan, from garrytan/gstack. Tags: cleanup, configuration, ios.

What it does

Remove the DebugBridge SPM package and all #if DEBUG wiring from an iOS app. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill ios-clean

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/ios-clean ~/.claude/skills/ios-clean

Safety box score

Grade C, moderate risk: 42 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill cleans up an iOS app by editing `Package.swift`, stripping `#if DEBUG` bridge wiring, deleting generated bridge artifacts, and running an `xcodebuild` release verification. The main risks are local source-tree deletion and opaque helper scripts that drive the workflow and telemetry.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution3 (high)It explicitly runs shell commands and a build/install step, including `~/.claude/skills/gstack/bin/gstack-skill-start` and `xcodebuild -scheme <SchemeName> ... build install -configuration Release`, so it can execute native tooling on the machine.
Network access0 (none)The skill does not explicitly download from or send to remote hosts; there are no `curl`, `wget`, API, or publish commands in the reviewed file.
Filesystem reach2 (moderate)It edits app source and `Package.swift`, deletes `DebugBridge/` and `DebugBridgeGenerated/`, and targets `gstack-ios-qa.token` under `NSTemporaryDirectory()` on the device, so it can remove local files beyond a single line edit.
Secrets & credentials1 (low)It touches a token file by name, `gstack-ios-qa.token`, but only as a best-effort delete and does not read or exfiltrate credentials, keys, or browser sessions.
Privilege & persistence0 (none)There is no sudo, service registration, global install, shell startup edit, or other privilege-changing command in the skill.
Instruction hijack surface1 (low)It tells the agent to follow `GSTACK_INSTRUCTION_BEGIN` blocks from `gstack-skill-start` output, which is a runtime instruction channel that could be abused if the helper were compromised, though it is gated by `SESSION_ID`.
Irreversible actions2 (moderate)The skill autonomously removes code and generated artifacts after confirmation, and runs verification commands, but it keeps the cleanup gated behind user approval per phase.
Transparency2 (moderate)Several key behaviors live in external helper scripts under `~/.claude/skills/gstack/bin/` that are referenced but not shown here, so a reviewer cannot inspect their implementation from this file alone.

Before installing

Rated 2026-10-19 by an automated review of 1 file from the skill's repository.

Source

Repository
garrytan/gstack (all skills from this repository)
Path
ios-clean/SKILL.md
Branch
main
Updated
2026-10-05