setup-gbrain
Facilitates the setup of gbrain for coding agents, enabling seamless integration and operation of local PGLite or Supabase brains.
Install this skill
Security score
The setup-gbrain skill was audited on Jun 10, 2026 and we found 150 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 33 | ```bash |
Template literal with variable interpolation in command context
| 283 | ```bash |
Template literal with variable interpolation in command context
| 418 | ```bash |
Template literal with variable interpolation in command context
| 452 | echo "before relying on \`gbrain search\` for code questions in this worktree." |
Template literal with variable interpolation in command context
| 580 | ```bash |
Template literal with variable interpolation in command context
| 837 | ```bash |
Template literal with variable interpolation in command context
| 1053 | ```bash |
Template literal with variable interpolation in command context
| 1137 | ```bash |
Template literal with variable interpolation in command context
| 1331 | ```bash |
Template literal with variable interpolation in command context
| 1361 | ```bash |
Ngrok tunnel reference
| 1069 | For users whose brain runs on another machine (Tailscale, ngrok, internal |
Access to hidden dotfiles in home directory
| 34 | _UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true) |
Access to hidden dotfiles in home directory
| 36 | mkdir -p ~/.gstack/sessions |
Access to hidden dotfiles in home directory
| 37 | touch ~/.gstack/sessions/"$PPID" |
Access to hidden dotfiles in home directory
| 38 | _SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ') |
Access to hidden dotfiles in home directory
| 39 | find ~/.gstack/sessions -mmin +120 -type f -exec rm {} + 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 40 | _PROACTIVE=$(~/.claude/skills/gstack/bin/gstack-config get proactive 2>/dev/null || echo "true") |
Access to hidden dotfiles in home directory
| 41 | _PROACTIVE_PROMPTED=$([ -f ~/.gstack/.proactive-prompted ] && echo "yes" || echo "no") |
Access to hidden dotfiles in home directory
| 44 | _SKILL_PREFIX=$(~/.claude/skills/gstack/bin/gstack-config get skill_prefix 2>/dev/null || echo "false") |
Access to hidden dotfiles in home directory
| 48 | source <(~/.claude/skills/gstack/bin/gstack-repo-mode 2>/dev/null) || true |
Access to hidden dotfiles in home directory
| 51 | _SESSION_KIND=$(~/.claude/skills/gstack/bin/gstack-session-kind 2>/dev/null || echo "interactive") |
Access to hidden dotfiles in home directory
| 54 | _LAKE_SEEN=$([ -f ~/.gstack/.completeness-intro-seen ] && echo "yes" || echo "no") |
Access to hidden dotfiles in home directory
| 56 | _TEL=$(~/.claude/skills/gstack/bin/gstack-config get telemetry 2>/dev/null || true) |
Access to hidden dotfiles in home directory
| 57 | _TEL_PROMPTED=$([ -f ~/.gstack/.telemetry-prompted ] && echo "yes" || echo "no") |
Access to hidden dotfiles in home directory
| 62 | _EXPLAIN_LEVEL=$(~/.claude/skills/gstack/bin/gstack-config get explain_level 2>/dev/null || echo "default") |
Access to hidden dotfiles in home directory
| 65 | _QUESTION_TUNING=$(~/.claude/skills/gstack/bin/gstack-config get question_tuning 2>/dev/null || echo "false") |
Access to hidden dotfiles in home directory
| 67 | mkdir -p ~/.gstack/analytics |
Access to hidden dotfiles in home directory
| 69 | echo '{"skill":"setup-gbrain","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(_repo=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null | tr -cd 'a-zA-Z0-9._-'); echo "${_repo:-un |
Access to hidden dotfiles in home directory
| 71 | for _PF in $(find ~/.gstack/analytics -maxdepth 1 -name '.pending-*' 2>/dev/null); do |
Access to hidden dotfiles in home directory
| 73 | if [ "$_TEL" != "off" ] && [ -x "~/.claude/skills/gstack/bin/gstack-telemetry-log" ]; then |
Access to hidden dotfiles in home directory
| 74 | ~/.claude/skills/gstack/bin/gstack-telemetry-log --event-type skill_run --skill _pending_finalize --outcome unknown --session-id "$_SESSION_ID" 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 80 | eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 86 | ~/.claude/skills/gstack/bin/gstack-learnings-search --limit 3 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 91 | ~/.claude/skills/gstack/bin/gstack-timeline-log '{"skill":"setup-gbrain","event":"started","branch":"'"$_BRANCH"'","session":"'"$_SESSION_ID"'"}' 2>/dev/null & |
Access to hidden dotfiles in home directory
| 96 | _ROUTING_DECLINED=$(~/.claude/skills/gstack/bin/gstack-config get routing_declined 2>/dev/null || echo "false") |
Access to hidden dotfiles in home directory
| 107 | _CHECKPOINT_MODE=$(~/.claude/skills/gstack/bin/gstack-config get checkpoint_mode 2>/dev/null || echo "explicit") |
Access to hidden dotfiles in home directory
| 108 | _CHECKPOINT_PUSH=$(~/.claude/skills/gstack/bin/gstack-config get checkpoint_push 2>/dev/null || echo "false") |
Access to hidden dotfiles in home directory
| 129 | In plan mode, allowed because they inform the plan: `$B`, `$D`, `codex exec`/`codex review`, writes to `~/.gstack/`, writes to the plan file, and `open` for generated artifacts. |
Access to hidden dotfiles in home directory
| 137 | If `SKILL_PREFIX` is `"true"`, suggest/invoke `/gstack-*` names. Disk paths stay `~/.claude/skills/gstack/[skill-name]/SKILL.md`. |
Access to hidden dotfiles in home directory
| 139 | If output shows `UPGRADE_AVAILABLE <old> <new>`: read `~/.claude/skills/gstack/gstack-upgrade/SKILL.md` and follow the "Inline upgrade flow" (auto-upgrade if configured, otherwise AskUserQuestion with |
Access to hidden dotfiles in home directory
| 144 | - Missing `~/.claude/skills/gstack/.feature-prompted-continuous-checkpoint`: AskUserQuestion for Continuous checkpoint auto-commits. If accepted, run `~/.claude/skills/gstack/bin/gstack-config set che |
Access to hidden dotfiles in home directory
| 145 | - Missing `~/.claude/skills/gstack/.feature-prompted-model-overlay`: inform "Model overlays are active. MODEL_OVERLAY shows the patch." Always touch marker. |
Access to hidden dotfiles in home directory
| 158 | If B: run `~/.claude/skills/gstack/bin/gstack-config set explain_level terse`. |
Access to hidden dotfiles in home directory
| 162 | rm -f ~/.gstack/.writing-style-prompt-pending |
Access to hidden dotfiles in home directory
| 163 | touch ~/.gstack/.writing-style-prompted |
Access to hidden dotfiles in home directory
| 172 | touch ~/.gstack/.completeness-intro-seen |
Access to hidden dotfiles in home directory
| 185 | If A: run `~/.claude/skills/gstack/bin/gstack-config set telemetry community` |
Access to hidden dotfiles in home directory
| 195 | If B→A: run `~/.claude/skills/gstack/bin/gstack-config set telemetry anonymous` |
Access to hidden dotfiles in home directory
| 196 | If B→B: run `~/.claude/skills/gstack/bin/gstack-config set telemetry off` |
Access to hidden dotfiles in home directory
| 200 | touch ~/.gstack/.telemetry-prompted |
Access to hidden dotfiles in home directory
| 213 | If A: run `~/.claude/skills/gstack/bin/gstack-config set proactive true` |
Access to hidden dotfiles in home directory
| 214 | If B: run `~/.claude/skills/gstack/bin/gstack-config set proactive false` |
Access to hidden dotfiles in home directory
| 218 | touch ~/.gstack/.proactive-prompted |
Access to hidden dotfiles in home directory
| 260 | If B: run `~/.claude/skills/gstack/bin/gstack-config set routing_declined true` and say they can re-enable with `gstack-config set routing_declined false`. |
Access to hidden dotfiles in home directory
| 264 | If `VENDORED_GSTACK` is `yes`, warn once via AskUserQuestion unless `~/.gstack/.vendoring-warned-$SLUG` exists: |
Access to hidden dotfiles in home directory
| 276 | 3. Run `~/.claude/skills/gstack/bin/gstack-team-init required` (or `optional`) |
Access to hidden dotfiles in home directory
| 278 | 5. Tell the user: "Done. Each developer now runs: `cd ~/.claude/skills/gstack && ./setup --team`" |
Access to hidden dotfiles in home directory
| 284 | eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 285 | touch ~/.gstack/.vendoring-warned-${SLUG:-unknown} |
Access to hidden dotfiles in home directory
| 427 | _BRAIN_SYNC_BIN="~/.claude/skills/gstack/bin/gstack-brain-sync" |
Access to hidden dotfiles in home directory
| 428 | _BRAIN_CONFIG_BIN="~/.claude/skills/gstack/bin/gstack-config" |
Access to hidden dotfiles in home directory
| 532 | If A/B and `~/.gstack/.git` is missing, ask whether to run `gstack-artifacts-init`. Do not block the skill. |
Access to hidden dotfiles in home directory
| 537 | "~/.claude/skills/gstack/bin/gstack-brain-sync" --discover-new 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 538 | "~/.claude/skills/gstack/bin/gstack-brain-sync" --once 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 581 | eval "$(~/.claude/skills/gstack/bin/gstack-slug 2>/dev/null)" |
Access to hidden dotfiles in home directory
| 598 | ~/.claude/skills/gstack/bin/gstack-decision-search --recent 5 2>/dev/null |
Access to hidden dotfiles in home directory
| 607 | **Cross-session decisions.** If `ACTIVE DECISIONS` are listed, treat them as prior settled calls with their rationale — do not silently re-litigate them; if you're about to reverse one, say so explici |
Access to hidden dotfiles in home directory
| 620 | Curated jargon list lives at `~/.claude/skills/gstack/scripts/jargon-list.json` (80+ terms). On the first jargon term you encounter this session, Read that file once; treat the `terms` array as the ca |
Access to hidden dotfiles in home directory
| 666 | Before each AskUserQuestion, choose `question_id` from `scripts/question-registry.ts` or `{skill}-{slug}`, then run `~/.claude/skills/gstack/bin/gstack-question-preference --check "<id>"`. `AUTO_DECID |
Access to hidden dotfiles in home directory
| 674 | ~/.claude/skills/gstack/bin/gstack-question-log '{"skill":"setup-gbrain","question_id":"<id>","question_summary":"<short>","category":"<approval|clarification|routing|cherry-pick|feedback-loop>","door |
Access to hidden dotfiles in home directory
| 683 | ~/.claude/skills/gstack/bin/gstack-question-preference --write '{"question_id":"<id>","preference":"<pref>","source":"inline-user","free_text":"<optional original words>"}' |
Access to hidden dotfiles in home directory
| 703 | ~/.claude/skills/gstack/bin/gstack-learnings-log '{"skill":"SKILL_NAME","type":"operational","key":"SHORT_KEY","insight":"DESCRIPTION","confidence":N,"source":"observed"}' |
Access to hidden dotfiles in home directory
| 713 | `~/.gstack/analytics/`, matching preamble analytics writes. |
Access to hidden dotfiles in home directory
| 720 | rm -f ~/.gstack/analytics/.pending-"$_SESSION_ID" 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 722 | ~/.claude/skills/gstack/bin/gstack-timeline-log '{"skill":"SKILL_NAME","event":"completed","branch":"'$(git branch --show-current 2>/dev/null || echo unknown)'","outcome":"OUTCOME","duration_s":"'"$_T |
Access to hidden dotfiles in home directory
| 725 | echo '{"skill":"SKILL_NAME","duration_s":"'"$_TEL_DUR"'","outcome":"OUTCOME","browse":"USED_BROWSE","session":"'"$_SESSION_ID"'","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> ~/.gstack/analytics/skill- |
Access to hidden dotfiles in home directory
| 728 | if [ "$_TEL" != "off" ] && [ -x ~/.claude/skills/gstack/bin/gstack-telemetry-log ]; then |
Access to hidden dotfiles in home directory
| 729 | ~/.claude/skills/gstack/bin/gstack-telemetry-log \ |
Access to hidden dotfiles in home directory
| 774 | ~/.claude/skills/gstack/bin/gstack-gbrain-detect |
Access to hidden dotfiles in home directory
| 798 | non-working local engine (Garry's repro: `~/.gbrain/config.json` points at a |
Access to hidden dotfiles in home directory
| 803 | > ELI10: gbrain has a config at `~/.gbrain/config.json` but the engine it points |
Access to hidden dotfiles in home directory
| 820 | > ❌ Destructive — existing config moved to ~/.gbrain/config.json.gstack-bak-{ts} |
Access to hidden dotfiles in home directory
| 830 | **If A (Retry)**: re-run `~/.claude/skills/gstack/bin/gstack-gbrain-detect` |
Access to hidden dotfiles in home directory
| 851 | echo "PGLite directory at ~/.gbrain/pglite/ may be in a partial state — \`rm -rf ~/.gbrain/pglite\` if needed before retrying." >&2 |
Access to hidden dotfiles in home directory
| 917 | ~/.claude/skills/gstack/bin/gstack-gbrain-install |
Access to hidden dotfiles in home directory
| 937 | . ~/.claude/skills/gstack/bin/gstack-gbrain-lib.sh |
Access to hidden dotfiles in home directory
| 945 | printf '%s' "$GBRAIN_POOLER_URL" | ~/.claude/skills/gstack/bin/gstack-gbrain-supabase-verify - |
Access to hidden dotfiles in home directory
| 958 | now persisted in `~/.gbrain/config.json` at mode 0600 by gbrain itself. |
Access to hidden dotfiles in home directory
| 976 | . ~/.claude/skills/gstack/bin/gstack-gbrain-lib.sh |
Access to hidden dotfiles in home directory
| 989 | orgs=$(~/.claude/skills/gstack/bin/gstack-gbrain-supabase-provision list-orgs --json) |
Access to hidden dotfiles in home directory
| 1018 | result=$(~/.claude/skills/gstack/bin/gstack-gbrain-supabase-provision \ |
Access to hidden dotfiles in home directory
| 1021 | ~/.claude/skills/gstack/bin/gstack-gbrain-supabase-provision wait "$INFLIGHT_REF" --json |
Access to hidden dotfiles in home directory
| 1022 | pooler=$(~/.claude/skills/gstack/bin/gstack-gbrain-supabase-provision \ |
Access to hidden dotfiles in home directory
| 1087 | . ~/.claude/skills/gstack/bin/gstack-gbrain-lib.sh |
Access to hidden dotfiles in home directory
| 1097 | ~/.claude/skills/gstack/bin/gstack-gbrain-mcp-verify "$MCP_URL") |
Access to hidden dotfiles in home directory
| 1131 | > ✅ Zero local state — only `~/.claude.json` MCP registration |
Access to hidden dotfiles in home directory
| 1138 | ~/.claude/skills/gstack/bin/gstack-gbrain-install || exit $? |
Access to hidden dotfiles in home directory
| 1140 | # existing ~/.gbrain/config.json first (rollback if init fails). |
Access to hidden dotfiles in home directory
| 1155 | echo "gbrain init failed. Existing config (if any) was restored. PGLite at ~/.gbrain/pglite/ may be in a partial state — \`rm -rf ~/.gbrain/pglite\` to reset." >&2 |
Access to hidden dotfiles in home directory
| 1180 | resting state in `~/.claude.json` mode 0600. |
Access to hidden dotfiles in home directory
| 1241 | ~10ms. The token's resting state is `~/.claude.json` (mode 0600 — Claude |
Access to hidden dotfiles in home directory
| 1280 | current_tier=$(~/.claude/skills/gstack/bin/gstack-gbrain-repo-policy get) |
Access to hidden dotfiles in home directory
| 1298 | ~/.claude/skills/gstack/bin/gstack-gbrain-repo-policy set "$REMOTE" "$TIER" |
Access to hidden dotfiles in home directory
| 1328 | `~/.gstack-artifacts-remote.txt`. Pass `--url-form-supported` from Step 4c's |
Access to hidden dotfiles in home directory
| 1333 | ~/.claude/skills/gstack/bin/gstack-artifacts-init --url-form-supported "$URL_FORM" |
Access to hidden dotfiles in home directory
| 1334 | ~/.claude/skills/gstack/bin/gstack-config set artifacts_sync_mode artifacts-only |
Access to hidden dotfiles in home directory
| 1352 | any gbrain client. The helper creates a `git worktree` of `~/.gstack/`, |
Access to hidden dotfiles in home directory
| 1356 | Capture the database URL out of `~/.gbrain/config.json` first and pass it |
Access to hidden dotfiles in home directory
| 1358 | `~/.gbrain/config.json` mid-sync (e.g., concurrent `gbrain init` runs |
Access to hidden dotfiles in home directory
| 1365 | c = json.load(open(os.path.expanduser('~/.gbrain/config.json'))) |
Access to hidden dotfiles in home directory
| 1370 | ~/.claude/skills/gstack/bin/gstack-gbrain-source-wireup --strict \ |
Access to hidden dotfiles in home directory
| 1375 | or no `~/.gstack/.git` yet) so the user sees the failure rather than silently |
Access to hidden dotfiles in home directory
| 1395 | curated `~/.gstack/` artifacts into gbrain so the retrieval surface |
Access to hidden dotfiles in home directory
| 1400 | ~/.claude/skills/gstack/bin/gstack-memory-ingest --probe |
Access to hidden dotfiles in home directory
| 1444 | ~/.claude/skills/gstack/bin/gstack-config set transcript_ingest_mode <choice> |
Access to hidden dotfiles in home directory
| 1445 | ~/.claude/skills/gstack/bin/gstack-gbrain-sync --full --no-brain-sync |
Access to hidden dotfiles in home directory
| 1473 | - Token: stored in ~/.claude.json (do not commit; never written to CLAUDE.md) |
Access to hidden dotfiles in home directory
| 1480 | in to git in many projects). It lives only in `~/.claude.json` where |
Access to hidden dotfiles in home directory
| 1489 | - Config file: ~/.gbrain/config.json (mode 0600) |
Access to hidden dotfiles in home directory
| 1516 | - `~/.gstack/` curated memory (registered as `gstack-brain-<user>` source via |
Access to hidden dotfiles in home directory
| 1585 | The brain trust policy controls whether gstack auto-pushes `~/.gstack/` |
Access to hidden dotfiles in home directory
| 1593 | _HASH=$(~/.claude/skills/gstack/bin/gstack-config endpoint-hash 2>/dev/null) |
Access to hidden dotfiles in home directory
| 1594 | _POLICY=$(~/.claude/skills/gstack/bin/gstack-config get brain_trust_policy@$_HASH 2>/dev/null || echo unset) |
Access to hidden dotfiles in home directory
| 1608 | ~/.claude/skills/gstack/bin/gstack-config set brain_trust_policy@$_HASH personal |
Access to hidden dotfiles in home directory
| 1618 | > Personal: gstack auto-pushes ~/.gstack/ artifacts (CEO plans, design |
Access to hidden dotfiles in home directory
| 1634 | ~/.claude/skills/gstack/bin/gstack-config set brain_trust_policy@$_HASH <personal|shared> |
Access to hidden dotfiles in home directory
| 1641 | _CURRENT_SYNC=$(~/.claude/skills/gstack/bin/gstack-config get artifacts_sync_mode 2>/dev/null || echo off) |
Access to hidden dotfiles in home directory
| 1643 | ~/.claude/skills/gstack/bin/gstack-config set artifacts_sync_mode full |
Access to hidden dotfiles in home directory
| 1659 | ~/.claude/skills/gstack/bin/gstack-gbrain-detect 2>/dev/null || true |
Access to hidden dotfiles in home directory
| 1660 | ~/.claude/skills/gstack/bin/gstack-config get transcript_ingest_mode 2>/dev/null || echo "off" |
Access to hidden dotfiles in home directory
| 1661 | ~/.claude/skills/gstack/bin/gstack-config get artifacts_sync_mode 2>/dev/null || echo "off" |
Access to hidden dotfiles in home directory
| 1662 | [ -f ~/.gstack/.gbrain-sync-state.json ] && cat ~/.gstack/.gbrain-sync-state.json || echo "{}" |
Access to hidden dotfiles in home directory
| 1681 | Code search ..... {OK local-pglite (~/.gbrain/pglite) | N/A declined at Step 4d} |
Access to hidden dotfiles in home directory
| 1695 | `~/.gstack/transcripts/run-<pid>-<ts>/` and gstack-brain-sync pushes them |
Access to hidden dotfiles in home directory
| 1740 | `ref` doesn't match the user's active `~/.gbrain/config.json` pooler URL. |
Access to hidden dotfiles in home directory
| 1783 | that holds the pooler URL long-term is `~/.gbrain/config.json`, written |
Access to hidden dotfiles in home directory
| 1788 | - **Concurrent-run lock.** At skill start, `mkdir ~/.gstack/.setup-gbrain.lock.d` |
Access to hidden dotfiles in home directory
| 1790 | is running. Wait for it, or `rm -rf ~/.gstack/.setup-gbrain.lock.d` if |
External URL reference
| 168 | If `LAKE_INTRO` is `no`: say "gstack follows the **Boil the Ocean** principle — do the complete thing when AI makes marginal cost near-zero. Read more: https://garryslist.org/posts/boil-the-ocean" Off |
External URL reference
| 171 | open https://garryslist.org/posts/boil-the-ocean |
External URL reference
| 970 | > https://supabase.com/dashboard/account/tokens — we recommend revoking |
External URL reference
| 993 | organizations. Create one at https://supabase.com/dashboard, then re-run |
External URL reference
| 1011 | echo "Delete: https://supabase.com/dashboard/project/$INFLIGHT_REF"; \ |
External URL reference
| 1034 | > https://supabase.com/dashboard/account/tokens — we've already discarded |
External URL reference
| 1041 | 1. Login at https://supabase.com/dashboard |
External URL reference
| 1077 | Paste your gbrain MCP URL (e.g. https://wintermute.tail554574.ts.net:3131/mcp): |
External URL reference
| 1081 | a credential). Validate it starts with `https://` (require TLS for any |
External URL reference
| 1082 | non-loopback host); refuse `http://` for non-localhost. |
External URL reference
| 1736 | https://api.supabase.com/v1/projects) |
External URL reference
| 1748 | https://api.supabase.com/v1/projects/$REF |