setup-deploy

An agent skill by garrytan, from garrytan/gstack. Tags: configuration, deployment, setup, workflow.

What it does

Configure deployment settings for /land-and-deploy.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill setup-deploy

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/setup-deploy ~/.claude/skills/setup-deploy

Safety box score

Grade D, elevated risk: 54 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill bootstraps deploy metadata for `/land-and-deploy`, then writes it into `CLAUDE.md`. The main risks are that it shells out to local CLIs and live URLs, can touch authenticated platform sessions, and contains instruction-following logic that can bypass asking the user in some session modes.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It runs multiple shell commands to inspect and verify the repo and deployment state, including `grep`, `find`, `curl`, `gh repo view`, and platform CLIs like `fly` and `vercel`.
Network access	2 (moderate)	It makes live HTTP requests to production endpoints for health checks, e.g. `curl -s -o /dev/null -w "%{http_code}" https://{app}.fly.dev/health` and `curl -sf "{health-check-url}"`.
Filesystem reach	2 (moderate)	It reads and overwrites `CLAUDE.md` in the repo and invokes scripts from `~/.claude/skills/gstack/bin/...`, so it touches files outside the working tree.
Secrets & credentials	2 (moderate)	It probes authenticated tooling and secrets-adjacent state, including `RENDER_API_KEY`, `fly status --app {app}`, `vercel ls --prod`, and `gh repo view`, without printing key bytes.
Privilege & persistence	0 (none)	There is no sudo, service install, shell startup edit, or global system change in the workflow; it stays at repo/config and CLI-query level.
Instruction hijack surface	3 (high)	It tells the agent to follow instruction blocks from `gstack-skill-start` and to auto-choose options in `SESSION_KIND: spawned` or `unattended` mode, which is a direct instruction-following and confirmation-bypass mechanism.
Irreversible actions	1 (low)	The skill does not deploy or publish itself, but it writes deploy settings that make `/land-and-deploy` automatic later and can set automatic-on-push triggers.
Transparency	1 (low)	Core behavior is delegated to external scripts like `~/.claude/skills/gstack/bin/gstack-skill-start`, `gstack-question-preference`, and `gstack-skill-end`, which are not visible in the provided file.

Before installing

Inspect `~/.claude/skills/gstack/bin/gstack-skill-start` and `gstack-skill-end` before trusting the auto-decide and telemetry behavior.
Confirm `CLAUDE.md` is safe to overwrite, since this skill stores deploy settings there.
Run it first in a scratch repo or with non-prod credentials if your platform CLIs are already logged in.
Check whether you are okay with live `curl` probes against the production URL during setup.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: setup-deploy/SKILL.md
Branch: main
Updated: 2026-10-05

setup-benny — Configure Benny and prepare its triage and repro automations.
setup-pstack — Configure which models pstack uses per role and at what reasoning budget.
setup-matt-pocock-skills — Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout.
wizard — Generate an interactive bash wizard that walks a human through steps only they can perform.
deployment — Deploy applications to DigitalOcean App Platform via GitHub Actions with proper environment management and secrets handling.
eas-hosting — EAS service (paid). Deploy Expo websites and Expo Router API routes to EAS Hosting - export the web bundle, run eas deploy for production and PR preview URLs.