landing-report

An agent skill by garrytan, from garrytan/gstack. Tags: dashboard, project-management, tracking.

What it does

Read-only queue dashboard for workspace-aware ship. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill landing-report

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/landing-report ~/.claude/skills/landing-report

Safety box score

Grade D, elevated risk: 58 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only landing dashboard, but it shells out to local gstack binaries plus `gh`, `git`, and `bun` to inspect remote version state and then logs telemetry. The main risks are broad code execution through those commands, network access to remote repos, and a runtime instruction channel that trusts output from helper tools.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly runs Bash plus `gh`, `git`, `bun`, and local binaries like `~/.claude/skills/gstack/bin/gstack-skill-start` and `gstack-next-version`, so the skill can execute shell-backed code paths.
Network access	2 (moderate)	It calls `gh pr view`, `gh repo view`, and `git fetch origin "$BASE_BRANCH"`, so it contacts remote hosts for repo metadata and branch state.
Filesystem reach	2 (moderate)	It reads `VERSION`, writes `/tmp/landing-*.json`, and its lifecycle/telemetry steps target `~/.gstack/` and `$GSTACK_STATE_ROOT/analytics/`, so it touches files outside the project.
Secrets & credentials	2 (moderate)	The remote queries use the user's authenticated `gh`/`git` sessions, so the skill can access private repo data through existing CLI logins even though it does not ask for raw tokens.
Privilege & persistence	0 (none)	No sudo, service install, shell startup edits, or global config changes are requested; the skill presents itself as a read-only snapshot.
Instruction hijack surface	3 (high)	It tells the agent to follow `GSTACK_INSTRUCTION_BEGIN...` blocks from command output and to obey runtime status lines, creating a strong prompt-injection channel from tool output.
Irreversible actions	0 (none)	It states `No mutations — just a snapshot` and only suggests what `/ship` would claim; it does not push, post, delete, or book anything.
Transparency	2 (moderate)	Core behavior is delegated to unread local tools (`gstack-skill-start`, `gstack-next-version`, `gstack-skill-end`, etc.), so the actual logic is not visible in this file.

Before installing

Inspect `~/.claude/skills/gstack/bin/gstack-skill-start`, `gstack-next-version`, and `gstack-skill-end` before trusting the workflow.
Run it once in a scratch repo and confirm you are OK with `gh`/`git fetch` traffic using your logged-in credentials.
Verify writes to `~/.gstack/`, `$GSTACK_STATE_ROOT/analytics/`, and `/tmp/landing-*.json` are acceptable in your environment.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: landing-report/SKILL.md
Branch: main
Updated: 2026-10-05

analytics — When the user wants to set up, improve, or audit analytics tracking and measurement.
seo-maps — Maps intelligence for local SEO: geo-grid rank tracking, GBP profile auditing via API, review intelligence across Google/Tripadvisor/Trustpilot.
to-tickets — Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges.
wayfinder — Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker.
attribution — When the user wants to figure out which marketing actually drives conversions and revenue, choose or interpret an attribution model.
caveman-stats — Show recorded output and cache-read token usage and mode attribution for the current Claude Code session, or locate the host's native usage report.