gstack is a 🏷️#claude-code-skill pack by 📝Garry Tan (📝Y Combinator President and CEO) that provides 35 specialized agent roles spanning product strategy, design, code review, 📝Quality Assurance (QA), security, and shipping. 68K+ 📝GitHub stars. 📝Massachusetts Institute of Technology (MIT) licensed.
Philosophy
gstack treats the AI agent as a virtual product team — CEO, designer, engineer, QA lead, security officer — each with opinionated methodology. The core ethos is "Boil the Lake" — go deep, search before building, respect user sovereignty. It catches "AI slop" in design output and enforces structural rigor in planning.
Skill Categories
Product & Strategy
/office-hours— YC-style product interrogation. Reframes your idea before you code/plan-ceo-review— CEO-level strategic review of feature plans/autoplan— auto-pipeline: CEO review → design review → eng review/plan-eng-review— engineering architecture review (data flow, edge cases, tests)/plan-design-review— design dimension scoring (rate 0-10, explain what 10 looks like)/plan-devex-review— developer experience audit
Design
/design-consultation— build complete design system from scratch/design-review— visual design audit + iterative fix loop/design-shotgun— rapid visual design exploration (multiple variants)/design-html— production-quality HTML/CSS generation
Code Quality & Review
/review— pre-landing PR review with specialist sub-reviews (security, perf, API, testing, maintainability)/devex-review— developer experience review using real browser testing/cso— Chief Security Officer mode. OWASP Top 10, STRIDE, supply chain, secrets archaeology/benchmark— performance regression detection
QA & Testing
/qa— open real browser, find bugs, fix them, re-verify. Iterative/qa-only— same as /qa but report-only, no code changes/browse— headless browser commands (~100ms/command, real Chromium via Playwright)
Shipping & Deployment
/ship— full ship workflow: tests, review, VERSION bump, CHANGELOG, push, create PR/land-and-deploy— merge, deploy, canary verify/canary— post-deploy monitoring loop/document-release— update docs to match what shipped
Safety & Guards
/careful— warns before destructive commands (rm -rf, DROP TABLE, force-push)/freeze— locks edits to one directory/guard— activates both careful + freeze
Meta
/retro— weekly retrospective with per-person breakdowns/investigate— systematic root-cause debugging/learn— log and retrieve operational learnings/checkpoint— save/resume progress across sessions/health— code quality dashboard (weighted composite 0-10 score)
Technical Requirements
- Bun (JavaScript runtime) — required for building the headless browser binary
- Playwright + Chromium — installed automatically during setup for browser-based QA
Security Profile
- Telemetry is opt-in (off by default) — three tiers: off, anonymous, community. No code content or file paths are ever sent
- No auto-update when installed without team mode — stays at the installed version
- No data exfiltration — learnings stored locally at
~/.gstack/projects/ - Destructive command guardrails (
/careful,/freeze) are genuinely protective - State directory at
~/.gstack/stores config, session markers, project learnings