Security Review of gstack: Y Combinator CEO's Claude Code Toolkit

Background

gstack is an open-source toolkit released by Y Combinator president Garry Tan on March 12, 2026. It packages Claude Code — Anthropic's CLI-based AI coding agent — into a set of slash commands that automate plan reviews, code reviews, QA testing, shipping, and browser-based dogfooding. A persistent headless Chromium daemon provides the browser layer.

The README describes gstack as an opinionated, personal workflow system: “ten opinionated workflow skills” that turn “one generic assistant into a team of specialists.” It is explicitly framed as tooling built for one person's workflow, then open-sourced for others to adopt or fork.

This review examines the security boundaries of those markdown files and the server code that backs them. We found two server-level security issues in the headless browser daemon. The rest of this review is design analysis — how the tool handles trust boundaries between human intent and AI agent action, and what that means for users who adopt it without reading 600 lines of prompt instructions.

Methodology

The gstack repository (github.com/garrytan/gstack, version 0.4.4, commit c86faa7) was cloned and all files were read in full. The analysis covered every SKILL.md prompt template, the headless browser server source (browse/src/), the review checklist, the Greptile integration, the upgrade mechanism, supporting configuration files, tests, and project documentation (README, ARCHITECTURE.md, CONTRIBUTING.md, CHANGELOG.md).

This is a static review of prompt design, architectural decisions, and trust boundaries — not a live exploitation exercise. No running instance of gstack was attacked. Findings are based on what the prompts instruct the AI agent to do and what the server code permits.

Security Findings

// Cookie picker routes — no auth required (localhost-only)
if (url.pathname.startsWith('/cookie-picker')) {
  return handleCookiePickerRoute(url, req, browserManager);
}

{
  "pid": 12345,
  "port": 34567,
  "token": "a1b2c3d4-...",        // Bearer token — full browser control
  "startedAt": "2026-03-16T...",
  "serverPath": "/path/to/server.ts",
  "binaryVersion": "abc123"
}

Trust Boundary Analysis

The following are not vulnerabilities. They are design decisions that create novel trust boundaries between human intent and AI agent action. We document them because they matter for users evaluating the tool.

Localhost trust assumption

gstack's headless browser server treats localhost as a trusted zone. This is stated explicitly in cookie-picker-routes.ts: “no auth — localhost-only, accepted risk.” For many development tools this is reasonable. It is weaker than it appears in environments where untrusted code runs locally — npm postinstall scripts, VS Code extensions, and any process under the same UID. Finding 1 is a direct consequence of this assumption.

Greptile comment ingestion

The /review and /ship skills fetch Greptile bot comments from the GitHub API and feed them into Claude's context for classification. The entire comment body is ingested as trusted input. A compromised Greptile service could craft a comment body containing prompt injection payloads that influence how the AI classifies review findings.

The blast radius is limited: most consequential actions (applying fixes, acknowledging issues) are gated by AskUserQuestion prompts that require explicit user choice. The classification step itself (VALID vs FALSE POSITIVE vs SUPPRESSED) runs without human intervention, but the actions that follow it do not.

Autonomous commit and push

The /qa skill autonomously finds bugs by browsing a website, edits source code, and commits — up to 50 times per session with no human review gate. The /ship skill auto-generates CHANGELOG entries, splits changes into commits, pushes to remote, and creates a pull request. The prompt explicitly states: “Do NOT ask for confirmation at any step.”

These are intentional behaviors, not bugs. The user invokes them deliberately. But they represent a gap between what the human authorized (a single slash command) and what the AI agent executes (a multi-step workflow involving irreversible actions like git push and PR creation). Users who have not read the 600-line skill prompts may not understand the scope of what they are authorizing.

Design Review

The following are opinions about gstack's design. They are not security findings. We include them because they affect the practical value of the tool for users adopting it outside its original context.

Review checklist is Rails-centric

The review checklist that backs /review and /ship has four CRITICAL categories. Two — SQL & Data Safety and Race Conditions & Concurrency — contain heuristics specific to Ruby on Rails (sanitize_sql_array, update_column, find_or_create_by, .html_safe). The other two — LLM Output Trust Boundary and Enum & Value Completeness — are generic and apply across stacks. The INFORMATIONAL pass also includes generic categories (Crypto & Entropy, Time Window Safety, Type Coercion at Boundaries).

The README is transparent that gstack is opinionated. The issue is not that the checklist is Rails-focused — it is that the review output does not indicate which categories applied. A user running /review on a Go service sees “No issues found” without knowing that the SQL injection, XSS, and race condition heuristics did not apply to their code.

Review suppressions

The checklist pre-emptively silences certain finding categories, including “Regex doesn't handle edge case X when the input is constrained and X never occurs in practice.” Most suppressions are sensible noise reduction. This particular one embodies the assumption attackers target — that constrained input will stay constrained.

Vendored upgrade path

The vendored-install upgrade path replaces the entire gstack directory and deletes the backup (rm -rf "$INSTALL_DIR.bak"). The git-install path uses git reset --hard but stashes tracked changes first and preserves untracked files. If auto-upgrade is enabled, the vendored path can destroy customizations without explicit user action.

Prompt bloat

Every skill includes an identical preamble (~330 tokens) with upgrade checks, formatting rules, contributor mode instructions, and base branch detection. The preamble is generated from a shared template but duplicated in full into each SKILL.md. The /plan-ceo-review skill is 573 lines with 10 review sections, each requiring the AI to stop and ask the user a question. Longer prompts mean more competition for the model's attention — the most important instructions (security checklist categories) share context with upgrade checks and formatting boilerplate.

Disclosure

This review was performed on the publicly available gstack repository (github.com/garrytan/gstack, version 0.4.4, commit c86faa7). All findings are based on static analysis of prompt files, server source code, tests, and project documentation. No running instance of gstack was attacked or accessed.

gstack is open source under the MIT license. Several design decisions noted in this review (session tracking, contributor mode, the “opinionated” framing) are documented in the project's ARCHITECTURE.md, CONTRIBUTING.md, and README. This review aims to surface security considerations for users evaluating the tool, not to characterize documented features as undisclosed.