Gstack Review by @garrytan · Skillet

Gstack Review

Use before merging a branch or PR: review the diff for bugs that pass CI but break production, fix the obvious ones and ask about the rest. (gstack)

Permissions

Files

SKILL.md

gstack-review

Use before merging a branch or PR: review the diff for bugs that pass CI but break production, fix the obvious ones and ask about the rest. (gstack)

Review: find what passes CI but breaks in production

Start here. In the repository (cd into it first: the shell starts in the workspace root), run with execute (pass the base branch if you know it):

sh skills/gstack-review/scripts/diff-base.sh <base>

It prints the base, the merge base, the commits since the base and the diff stat, then NEXT: git diff <merge base>; run that and read the whole diff and every untracked file before you comment (on UNTRACKED_MORE:, list the rest with the command it names). On NOTHING_TO_REVIEW, say so and stop. On BASE: none, ask the user for the base branch or review the uncommitted changes it shows.

QM fills in the absolute path of the folder its skill tool synced (it prints that path too). If the script is missing, run this instead:

2 files · 13 KB11 KB

Version history

git merge-base origin/main HEAD
git diff --stat <merge-base>

AUTO-FIX (agent fixes without asking):     ASK (needs human judgment):
├─ Dead code / unused variables            ├─ Security (auth, XSS, injection)
├─ N+1 queries (missing eager loading)      ├─ Race conditions
├─ Stale comments contradicting code       ├─ Design decisions
├─ Magic numbers → named constants         ├─ Large fixes (>20 lines)
├─ Missing LLM output validation           ├─ Enum completeness
├─ Version/path mismatches                 ├─ Removing functionality
├─ Variables assigned but never read       └─ Anything changing user-visible
└─ Inline styles, O(n*m) view lookups         behavior

Gstack Review

Review: find what passes CI but breaks in production

How to review

Review Categories

Pass 1 — CRITICAL

SQL & Data Safety

Race Conditions & Concurrency

LLM Output Trust Boundary

Shell Injection (Python-specific)

Enum & Value Completeness

Pass 2 — INFORMATIONAL

Async/Sync Mixing (Python-specific)

Column/Field Name Safety

LLM Prompt Issues

Completeness Gaps

Time Window Safety

Timing-Dependent Tests

Type Coercion at Boundaries

View/Frontend

Fix-First Heuristic

Suppressions — DO NOT flag these

Verification of claims

Important Rules