pair-agent

An agent skill by garrytan, from garrytan/gstack. Tags: automation, browser, multi-agent, remote-workflow.

What it does

Pair a remote AI agent with your browser. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill pair-agent

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/pair-agent ~/.claude/skills/pair-agent

Safety box score

Grade F, high risk: 84 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill pairs another AI agent to your browser, often with broad read/write control and an optional internet-exposed ngrok tunnel. The main risks are remote access to logged-in browser sessions, prompt-injection via instruction blocks, and executing external helper scripts and installers from your home directory.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It shells out to local helpers and browser commands like `gstack-skill-start`, `$B pair-agent`, and `gstack-skill-end`, and can fetch and run a Bun installer script if bun is missing.
Network access	3 (high)	Remote pairing can open an ngrok tunnel "from the internet to this machine's browser," and the setup path also downloads from `https://bun.sh/install`.
Filesystem reach	2 (moderate)	It writes credentials and state outside the repo into home-dotdir paths such as `~/.openclaw/skills/gstack/browse-remote.json`, `~/.codex/skills/gstack/browse-remote.json`, `~/.cursor/skills/gstack/browse-remote.json`, and `~/.gstack/`.
Secrets & credentials	3 (high)	The whole point is to let another agent use your live browser session, and the text explicitly discusses cookies, storage, setup keys, session tokens, and protecting the ngrok authtoken.
Privilege & persistence	2 (moderate)	It asks for package-manager installs like `brew install ngrok` or `snap install ngrok`, and may lazy-install Chromium on first use, which changes the local environment.
Instruction hijack surface	3 (high)	It tells the model to "Treat the skill file as executable instructions, not reference" and to honor `GSTACK_INSTRUCTION` blocks from tool output, which is a direct prompt-injection channel.
Irreversible actions	3 (high)	It deliberately hands a remote agent its own browser tab with default broad access, plus optional `--control` / `--force-restart` paths that can stop, restart, or disconnect the browser.
Transparency	2 (moderate)	Critical behavior lives in external helpers and a generated binary not shown here, including `bin/gstack-skill-start`, `gstack-browser-ensure`, `browse/dist/browse`, and `gstack-skill-end`, so review of this file alone is incomplete.

Before installing

Read the helper scripts and binary paths it invokes: `gstack-skill-start`, `gstack-browser-ensure`, `browse/dist/browse`, and `gstack-skill-end`.
Try it first in a disposable browser profile or test account, because the default pairing grants another agent broad access to your live session.
If you do remote pairing, confirm you really want an ngrok tunnel from the internet to your browser before enabling it.
Decide in advance whether you trust the default access, or whether you need `--restrict read` / `--restrict "read,write"` instead.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: pair-agent/SKILL.md
Branch: main
Updated: 2026-10-05

agents-build — Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments.
app-platform-sandbox — Create and manage isolated container sandboxes for AI agent code execution.
continual-learning — Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to `agents-memory-updater`.
coordinating-multi-space-devops-agent — Coordinate the AWS DevOps Agent across multiple AgentSpaces from one Claude Code session — route questions to the right space (prod vs staging vs knowledge).
orchestrate — Use only when the user explicitly types `/orchestrate <goal>` to decompose a large task.
ralph-loop — Start a Ralph Loop for iterative self-referential development.