garrytan/gstack hook server skill
ai workflow automation
gstack is a collection of AI agent skills and workflows that structures Claude Code (and other AI coding agents) into specialized roles—CEO, engineering manager, designer, QA lead, security officer, and release engineer. It provides 23+ slash commands organized around a sprint workflow: think, plan, build, review, test, ship, and reflect.
Run /office-hours to interrogate product ideas before coding Use /plan-ceo-review, /plan-eng-review, and /plan-design-review to lock in architecture and scope Execute /review on branches and /qa on staging URLs to catch bugs automatically Run /ship to validate tests pass and open a production PR Install globally for personal use or in team mode so teammates auto-update 9 CRITICAL✓ 11 HIGH✓ 134 MEDIUM 74 LOW
✓ CRITICAL/HIGH reflect AI-verified findings (false positives excluded) · MEDIUM/LOW/INFO are unverified scanner output
AI-verified (CRITICAL/HIGH): 20 likely real (100%) 25 false positive — excluded from CRITICAL/HIGH count above
Findings by checker · 7 high-signal, 5 mostly false-positive (hidden by default)
CHK-129 11 findings 6 likely 5 false positive
45% FP CHK-081 6 findings 6 likely
0% FP CHK-102 2 findings 2 likely
0% FP CHK-089 1 finding 1 likely
0% FP CHK-040 1 finding 1 likely
0% FP CHK-073 1 finding 1 likely
0% FP CHK-042 1 finding 1 likely
0% FP ▼ Show 5 checkers that are mostly false positives (22 findings) 175 findings click to expand
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/dev-skill.ts
scripts/dev-skill.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/garry-output-comparison.ts
scripts/garry-output-comparison.ts
AI: likely real confirmed ▼
CHK-102 Supabase service_role key usage — bypasses Row Level Security unconditionally
supabase/functions/community-pulse/index.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/skill-check.ts
scripts/skill-check.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in scripts/host-config-export.ts
scripts/host-config-export.ts
AI: likely real confirmed ▼
CHK-102 Supabase service_role key usage — bypasses Row Level Security unconditionally
supabase/functions/update-check/index.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in browse/src/meta-commands.ts
browse/src/meta-commands.ts
AI: likely real confirmed ▼
CHK-081 Command injection risk — exec/execSync with string interpolation in lib/gbrain-exec.ts
lib/gbrain-exec.ts
AI: likely real confirmed ▼
CHK-089 --dangerously-skip-permissions in executable — all permission checks bypassed
scripts/preflight-agent-sdk.ts
AI: likely real confirmed ▼
CHK-040 AWS Access Key detected in test/brain-sync.test.ts [test context]
test/brain-sync.test.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
browse/src/browser-skill-commands.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — Token: str
browse/src/server.ts
AI: likely real likely ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in lib/bin-context.ts
lib/bin-context.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
browse/src/browse-client.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
browse/src/token-registry.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
ios-qa/daemon/src/types.ts
AI: likely real likely ▼
CHK-073 Curl Pipe Bash Install detected in .gitlab-ci.yml
.gitlab-ci.yml
AI: likely real likely ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in src/meta-commands.ts
browse/src/meta-commands.ts
AI: likely real likely ▼
CHK-129 Sensitive field in return type/schema — token: str
browse/src/cli.ts
AI: likely real likely ▼
CHK-042 SSH Private Key detected in test/telemetry.test.ts [test context]
test/telemetry.test.ts
AI: likely real likely ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in make-pdf/SKILL.md.tmpl
make-pdf/SKILL.md.tmpl
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in make-pdf/SKILL.md
make-pdf/SKILL.md
possible ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in setup-deploy/SKILL.md.tmpl
setup-deploy/SKILL.md.tmpl
possible ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in setup-deploy/SKILL.md
setup-deploy/SKILL.md
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/daemon-state.ts
design/src/daemon-state.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in scripts/gen-accessors.ts
ios-qa/scripts/gen-accessors.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/devicectl.ts
ios-qa/daemon/src/devicectl.ts
possible ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in bin/check-careful.sh
careful/bin/check-careful.sh
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in sections/audit-phases.md.tmpl
cso/sections/audit-phases.md.tmpl
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in sections/audit-phases.md
cso/sections/audit-phases.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in helpers/codex-session-runner.ts
test/helpers/codex-session-runner.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in helpers/agent-sdk-runner.ts
test/helpers/agent-sdk-runner.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in helpers/auq-sdk-capture.ts
test/helpers/auq-sdk-capture.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in helpers/e2e-helpers.ts
test/helpers/e2e-helpers.ts
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in helpers/capture-parity-baseline.ts
test/helpers/capture-parity-baseline.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in helpers/claude-pty-runner.ts
test/helpers/claude-pty-runner.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in helpers/secret-sink-harness.ts
test/helpers/secret-sink-harness.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in helpers/gemini-session-runner.ts
test/helpers/gemini-session-runner.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in helpers/session-runner.ts
test/helpers/session-runner.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in helpers/session-runner.ts
test/helpers/session-runner.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in providers/gpt.ts
test/helpers/providers/gpt.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in providers/gemini.ts
test/helpers/providers/gemini.ts
possible ▼
CHK-125b chmod — permission modification — no scope constraint in migrations/v1.27.0.0.sh
gstack-upgrade/migrations/v1.27.0.0.sh
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in hackernews-frontpage/script.ts
browser-skills/hackernews-frontpage/script.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in _lib/browse-client.ts
browser-skills/hackernews-frontpage/_lib/browse-client.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in specialists/performance.md
review/specialists/performance.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in specialists/security.md
review/specialists/security.md
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in resolvers/testing.ts
scripts/resolvers/testing.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in resolvers/codex-helpers.ts
scripts/resolvers/codex-helpers.ts
possible ▼
CHK-125b chmod — permission modification — no scope constraint in docker/Dockerfile.ci
.github/docker/Dockerfile.ci
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in workflows/make-pdf-gate.yml
.github/workflows/make-pdf-gate.yml
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in hooks/question-preference-hook.ts
hosts/claude/hooks/question-preference-hook.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in hooks/question-log-hook.ts
hosts/claude/hooks/question-log-hook.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in hooks/auq-error-fallback-hook.ts
hosts/claude/hooks/auq-error-fallback-hook.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/browser-manager.ts
browse/src/browser-manager.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/find-browse.ts
browse/src/find-browse.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/find-security-sidecar.ts
browse/src/find-security-sidecar.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/terminal-agent.ts
browse/src/terminal-agent.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/meta-commands.ts
browse/src/meta-commands.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/cli.ts
browse/src/cli.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/cli.ts
browse/src/cli.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/browse-client.ts
browse/src/browse-client.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/write-commands.ts
browse/src/write-commands.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/cookie-import-browser.ts
browse/src/cookie-import-browser.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/browser-skills.ts
browse/src/browser-skills.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/security-classifier.ts
browse/src/security-classifier.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/security-classifier.ts
browse/src/security-classifier.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/error-handling.ts
browse/src/error-handling.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/error-handling.ts
browse/src/error-handling.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/bun-polyfill.cjs
browse/src/bun-polyfill.cjs
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/security.ts
browse/src/security.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/security.ts
browse/src/security.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/domain-skill-commands.ts
browse/src/domain-skill-commands.ts
possible ▼
CHK-125a fs.writeFile — unrestricted file write — no scope constraint in src/domain-skill-commands.ts
browse/src/domain-skill-commands.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in src/security-sidecar-client.ts
browse/src/security-sidecar-client.ts
possible ▼
CHK-125 spawnSync() — synchronous process spawn — no scope constraint in src/config.ts
browse/src/config.ts
possible ▼
CHK-125 execSync() — synchronous shell execution — no scope constraint in src/project-slug.ts
browse/src/project-slug.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/server.ts
browse/src/server.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/server.ts
browse/src/server.ts
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in sections/test-coverage.md
ship/sections/test-coverage.md
possible ▼
CHK-125 eval() — arbitrary code execution — no scope constraint in sections/review-sections.md
plan-eng-review/sections/review-sections.md
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/diagram-prepass.ts
make-pdf/src/diagram-prepass.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/orchestrator.ts
make-pdf/src/orchestrator.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/browseClient.ts
make-pdf/src/browseClient.ts
possible ▼
CHK-125a fs.unlinkSync — file deletion — no scope constraint in src/setup.ts
make-pdf/src/setup.ts
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in src/setup.ts
make-pdf/src/setup.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/pdftotext.ts
make-pdf/src/pdftotext.ts
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in src/pdftotext.ts
make-pdf/src/pdftotext.ts
possible ▼
CHK-125 exec() — arbitrary code execution — no scope constraint in src/render.ts
make-pdf/src/render.ts
possible ▼
CHK-022 Trigger expansion pattern — proactive trigger
SKILL.md
possible ▼
CHK-027 Outbound network call in skill — external network call (verify direction — could be benign API fetch)
pair-agent/SKILL.md
possible ▼
CHK-027 Outbound network call in skill — external network call (verify direction — could be benign API fetch)
design-html/SKILL.md
possible ▼
CHK-027 Outbound network call in skill — external network call (verify direction — could be benign API fetch)
benchmark/SKILL.md
possible ▼
CHK-042 Generic API Key Assignment detected in test/helpers/hermetic-env.test.ts [test context]
test/helpers/hermetic-env.test.ts
possible ▼
CHK-102 Direct SQL execution — may bypass ORM-level access controls
test/skill-e2e-review-army.test.ts
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in USING_GBRAIN_WITH_GSTACK.md
USING_GBRAIN_WITH_GSTACK.md
possible ▼
CHK-125 subprocess module — arbitrary shell execution — no scope constraint in ARCHITECTURE.md
ARCHITECTURE.md
possible ▼
CHK-125 kubectl invocation — cluster command execution — no scope constraint in BROWSER.md
BROWSER.md
possible ▼
CHK-125b chmod — permission modification — no scope constraint in BROWSER.md
BROWSER.md
possible ▼
CHK-125b sudo invocation — privilege escalation — no scope constraint in setup
setup
possible ▼
▼ Show 25 false positives (13% of this view) Last scanned: Jul 11, 2026
More servers
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
skypilot-org/skypilot 85
obra/superpowers 85
Foundational skill pack by Jesse Vincent now in anthropics/claude-plugins-official. Includes ffuf web-fuzzing/pentest skill. Partial analysis done — full hook and plugin inspection pending. tier=T2
191k★
Significant-Gravitas/AutoGPT 85
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.
186k★
nanocoai/nanoclaw 85
A lightweight alternative to OpenClaw that runs in containers for security. Connects to WhatsApp, Telegram, Slack, Discord, Gmail and other messaging apps,, has memory, scheduled jobs, and runs directly on Anthropic's Agents SDK
30k★
google-gemini/gemini-cli 85
An open-source AI agent that brings the power of Gemini directly into your terminal.
106k★
Scan your entire org's MCP deployment
2,500+ repos pre-scored. 22% carry CRITICAL findings.