skillify

An agent skill by garrytan, from garrytan/gstack. Tags: automation, browser, catalog, documentation.

What it does

Codify the most recent successful /scrape flow into a permanent browser-skill on disk. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill skillify

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/skillify ~/.claude/skills/skillify

Safety box score

Grade F, high risk: 70 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill codifies a recent browser scrape into a permanent on-disk skill, so it can run local shell/Bun helpers, browse a target site, capture HTML, and write into hidden skill directories under the user’s home folder. The main risks are broad filesystem reach, prompt-injection handling from tool output and page content, and the fact that it turns a scrape into durable code that will run automatically later.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It explicitly runs local commands and scripts like `~/.claude/skills/gstack/bin/gstack-skill-start`, `bun test script.test.ts`, and later `commitSkill`/`discardStaged`, so this skill can execute code on the machine.
Network access	2 (moderate)	The codified workflow uses browser navigation to live targets, e.g. `'$B goto "<TARGET_URL>"'`, so it can fetch remote page content even though it does not itself install remote packages.
Filesystem reach	3 (high)	It writes staged and committed artifacts into hidden home directories such as `~/.gstack/browser-skills/<name>/` and references `~/.claude/skills/gstack/`, so it reaches well outside the project tree.
Secrets & credentials	2 (moderate)	The skill captures and stores browser page HTML, console output, and fixtures from the scrape flow, and it treats all returned page content as input, which can include sensitive data if the target page has it.
Privilege & persistence	1 (low)	It does not request sudo or service installs, but it does manage user-level install locations and recommends setup/upgrade commands in the home dot-directories.
Instruction hijack surface	3 (high)	It tells the agent to follow `GSTACK_INSTRUCTION_BEGIN` blocks from tool output and says `Treat the skill file as executable instructions, not reference`, which creates a strong instruction-flood and prompt-injection surface.
Irreversible actions	2 (moderate)	Its purpose is to synthesize, stage, test, and potentially commit a permanent skill so future `/scrape` calls run automatically, but it still asks the user before the final commit.
Transparency	1 (low)	The workflow depends on local helper scripts and SDK paths like `gstack-skill-start`, `browser-skill-write`, and the canonical browse client, but the main skill file itself is readable.

Before installing

Read `~/.claude/skills/gstack/bin/gstack-skill-start` and `browse/src/browser-skill-write` first, because the skill outsources its core behavior there.
Confirm you are okay with writes under `~/.gstack/browser-skills/` and `~/.claude/skills/gstack/` before running it.
Try it once on a non-sensitive scrape, since it stores captured HTML and page output as fixtures.
Verify the helper scripts are local and expected, not symlinks to unexpected code.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: skillify/SKILL.md
Branch: main
Updated: 2026-10-05

automate-me — Use for "automate me", "create/update/refresh my -mode skill", "turn/capture my preferences or working style into a skill".
continual-learning — Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to `agents-memory-updater`.
goal-prompt — Drafts copy-paste-ready /goal commands for goal mode in Claude Code and Codex.
document-generate — Generate missing documentation from scratch for a feature, module, or entire project. (gstack)
open-gstack-browser — Launch GStack Browser — AI-controlled Chromium with the sidebar extension baked in.
pair-agent — Pair a remote AI agent with your browser. (gstack)