retro

An agent skill by garrytan, from garrytan/gstack. Tags: analytics, review, tracking, trend-analysis.

What it does

Weekly engineering retrospective. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill retro

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/retro ~/.claude/skills/retro

Safety box score

Grade D, elevated risk: 56 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a retrospective/reporting skill that reads git history, optional local analytics, and sometimes cross-repo state, then writes snapshots and telemetry files. The main risks are broad prompt-control over the agent, networked git/hosting calls, and persistent writes outside the project tree into home-dotdir state.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It drives the agent through many shell commands and helper binaries, including `git fetch`, `git log`, `gh pr list`, `gstack-retro-metrics`, and `gstack-skill-end`, so it can execute real local tooling rather than staying read-only.
Network access	2 (moderate)	The workflow explicitly fetches remote refs with `git fetch origin <default>` and may call GitHub/GitLab APIs via `gh` or `glab`, so it can send requests off-machine.
Filesystem reach	2 (moderate)	It writes persistent artifacts to `.context/retros/.json`, `$GSTACK_STATE_ROOT/retros/.json`, and `$GSTACK_STATE_ROOT/analytics/`, and also reads optional local state files and home-dotdir config.
Secrets & credentials	1 (low)	It does not ask for passwords or credential stores, but it does inspect local git history and optional per-user analytics/learnings, which can expose sensitive work context.
Privilege & persistence	0 (none)	No sudo, global installs, services, scheduled tasks, or shell-startup edits are required; the workflow stays within normal user-space files and Git commands.
Instruction hijack surface	3 (high)	It repeatedly tells the agent to treat the skill file as executable instructions, to auto-choose recommended answers in spawned/unattended modes, and to honor instruction blocks from tool output, which is strong prompt-control pressure.
Irreversible actions	2 (moderate)	The skill automatically saves retrospectives, logs learnings, and writes telemetry, and it can compare or aggregate across repos, but it does not deploy, message, pay, or delete external resources.
Transparency	2 (moderate)	Important behavior is delegated to unread helper binaries under `~/.claude/skills/gstack/bin/` such as `gstack-skill-start`, `gstack-retro-metrics`, and `gstack-skill-end`, so a reviewer cannot fully audit the runtime behavior from these files alone.

Before installing

Read `SKILL.md` plus the helper binaries it invokes, especially `gstack-skill-start`, `gstack-retro-metrics`, and `gstack-skill-end`.
Decide whether you want it to write local history under `.context/retros/` and `$GSTACK_STATE_ROOT/`; it does this automatically.
Run it once on a scratch repo or test clone with network access allowed, because it will `git fetch origin` and may call GitHub/GitLab.
If you do not want cross-project history pulled in, set the cross-project learnings config before first use.

Rated 2026-10-16 by an automated review of 3 files from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: retro/SKILL.md
Branch: main
Updated: 2026-10-05

gstack-openclaw-retro — Weekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking.
analytics — When the user wants to set up, improve, or audit analytics tracking and measurement.
attribution — When the user wants to figure out which marketing actually drives conversions and revenue, choose or interpret an attribution model.
caveman-stats — Show recorded output and cache-read token usage and mode attribution for the current Claude Code session, or locate the host's native usage report.
seo-maps — Maps intelligence for local SEO: geo-grid rank tracking, GBP profile auditing via API, review intelligence across Google/Tripadvisor/Trustpilot.
seo-profound — Profound LLM citation tracker (extension). Time-series brand citation rates across ChatGPT, Perplexity, and other LLMs.