功能描述

世界顶级思维合集 —— 融合Google Staff Engineer、Martin Fowler/Kent Beck/Jeff Dean工程思维、Paul Graham/Sam Altman创业思维、Elon Musk创新思维、Stripe/Airbnb设计思维。v2.5.10：移除install.sh以完全消...

使用说明 (SKILL.md)

⚠️ 安全声明 | Security Notice

本技能为纯文档型技能（Documentation-only Skill）。

✅ 不包含任何可执行代码或外部 API 调用

✅ 不需要任何 API Key、凭证或 secrets

✅ 不访问网络、不读写用户文件（除标准 OpenClaw 工具调用外）

✅ 所有功能通过 AI 角色提示词（prompts）实现

✅ 无安装脚本，无外部依赖

提到的外部服务（GitHub、CI/CD、monitoring）仅用于：

在对话中提供最佳实践建议

指导用户如何配置这些服务

不直接调用这些服务的 API

gstack

Name: Gstack OpenClaw
Author: smseow001

gstack for OpenClaw —— 把 Garry Tan 的虚拟工程团队带到 OpenClaw 生态

将 AI Agent 从一个通用助手转变为结构化工程团队的 8 个核心角色

🎯 设计理念

Garry Tan (YC CEO) 用 Claude Code + gstack 在 60 天内产出 60 万行代码。我们把它移植到 OpenClaw，让每个人都能拥有虚拟工程团队。

核心思想：不是把 AI 当工具用，而是当团队管 —— 每个阶段切换不同专家角色。

📦 包含技能

技能	角色	用途
`gstack:ceo`	CEO / 产品经理	产品规划、需求分析、痛点挖掘
`gstack:eng`	工程经理	架构设计、技术选型、数据流规划
`gstack:design`	设计评审师	设计评审、AI Slop检测、设计系统生成
`gstack:investigate`	系统调试专家	根因分析、3次失败停止、Bug调查
`gstack:security`	首席安全官	OWASP Top 10、STRIDE威胁建模
`gstack:land`	部署验证工程师	PR合并、生产部署、健康验证
`gstack:canary`	金丝雀监控工程师 ⭐ NEW	金丝雀分析、自动回滚决策
`gstack:benchmark`	性能基准工程师 ⭐ NEW	Core Web Vitals、性能回归检测
`gstack:review`	代码审查员	代码审查、Bug 发现、性能优化建议
`gstack:qa`	QA 负责人	测试策略、验收标准、质量把关
`gstack:ship`	发布工程师	发版 checklist、部署流程、上线检查
`gstack:browse`	浏览器测试	网页抓取、功能验证、UI 检查
`gstack:retro`	复盘师	项目复盘、经验总结、改进建议
`gstack:office`	办公室时间	需求澄清、方向校准、头脑风暴

🚀 快速开始

1. 安装

clawhub install openclaw/gstack

或手动安装：

git clone https://github.com/openclaw/gstack-openclaw ~/.openclaw/skills/gstack
cd ~/.openclaw/skills/gstack && ./install.sh

2. 使用

在项目根目录创建 GSTACK.md 文件，记录项目上下文。

然后随时调用：

示例命令：

@gstack:ceo 帮我分析一下这个功能的产品价值
@gstack:review 审查一下这个模块的代码
@gstack:ship 准备发布 v1.0.0

🎭 工作流示例

新功能开发流程

@gstack:office — 澄清需求，确定方向
@gstack:ceo — 产品规划，写 PRD
@gstack:design — 设计评审，生成设计系统
@gstack:eng — 技术架构设计
【开发中...】
@gstack:review — 代码审查
@gstack:qa — 测试验收
@gstack:ship — 发布上线
@gstack:retro — 一周后复盘

📁 项目结构

文件组织：

SKILL.md — 本文件（主技能描述）
README.md — 详细使用文档
GSTACK.md.template — 项目上下文模板
_skills/ — 子技能目录
- plan-ceo/ — CEO 技能
- plan-eng/ — 工程经理技能
- design/ — 设计评审技能 (v2.5.0)
- investigate/ — 系统调试技能 (v2.5.1)
- security/ — 安全审计技能 (v2.5.2)
- land/ — 部署验证技能 (v2.5.3)
- canary/ — 金丝雀监控技能 (v2.5.4) ⭐ NEW
- benchmark/ — 性能基准技能 (v2.5.5) ⭐ NEW
- review/ — 代码审查技能
- qa/ — QA 技能
- ship/ — 发布技能
- browse/ — 浏览器测试技能
- retro/ — 复盘技能
- office/ — 办公室时间技能
- docs/ — 文档技能
- test/ — 测试技能
- deploy/ — 部署技能
- init/ — 初始化技能
- status/ — 状态追踪技能
- github/ — GitHub 集成技能
- notify/ — 通知技能
docs/ — 文档目录
- workflow.md — 完整工作流指南
- philosophy.md — 设计理念

🙏 致谢

Garry Tan —— 原创 gstack 作者
Y Combinator —— 持续推动创业生态
OpenClaw 社区 —— 让 AI Agent 触手可及

📄 License

MIT License —— 完全免费，随意使用、修改、分发

我们的目标：让每个开发者都能拥有 YC 级别的工程团队

Made with 🦞 by OpenClaw Community

安全使用建议

This package is mostly documentation and prompt templates and appears coherent with its stated purpose — but check a few things before installing: - Verify there is indeed no install.sh or other executable file in the distributed package (the docs contain mixed references to './install.sh' even though the changelog says it was removed). - Understand that many examples show network calls and test scripts (curl, fetch, Playwright). The skill itself doesn't require credentials, but if you grant OpenClaw tools permission to access files, browsers, or external APIs, the agent could perform those actions. Only grant such permissions after you review and are comfortable with the resulting behaviour. - If you plan to use sub-skills that interact with external services (WebPageTest, PageSpeed Insights, CI/CD), provide API keys only to the specific official skill that needs them — this gstack package should not demand secrets itself. - If you want maximum safety, install via the platform's verified 'clawhub install' path and avoid running any manual install scripts suggested in docs until you confirm they exist and are benign. Overall: coherent but inconsistent documentation signals (leftover install.sh references and illustrative network/code examples). If you need higher assurance, ask the publisher to confirm the removed-install.sh state and to remove any leftover install instructions that reference removed files.

功能分析

Type: OpenClaw Skill Name: gstack-openclaw-sms Version: 2.5.10 The gstack-openclaw skill bundle is a documentation-only collection of professional personas (CEO, Architect, Security Officer, etc.) designed to guide an AI agent through software development workflows. The package contains no executable code, and the author explicitly removed previous installation scripts (install.sh) in version 2.5.10 to ensure compliance with security standards. The instructions are purely prompt-based, focusing on engineering best practices, and do not contain any evidence of malicious intent, data exfiltration, or unauthorized system access.

能力标签

cryptocan-make-purchasesrequires-oauth-tokenrequires-sensitive-credentials

能力评估

✓ Purpose & Capability

Name/description and the provided SKILL.md files consistently describe a prompt-driven, role-based engineering assistant. The files are instruction-only (no code files or install spec) and the requested capabilities (design, review, benchmark, canary, etc.) are coherent with the provided content and examples.

⚠ Instruction Scope

The top-level SKILL.md explicitly asserts 'documentation-only' and 'no network / no file I/O' except via standard OpenClaw tools. However, multiple sub-skill docs include concrete code examples that call network endpoints (curl to webpagetest, fetch('/analytics'), Playwright scripts that open URLs) and the top SKILL.md (and README) contain manual install instructions that reference an './install.sh' command. The repository manifest shows no install script present, and SECURITY.md/README state install.sh was removed — the presence of references to it in some docs is an inconsistency. While these examples appear to be illustrative (not runtime instructions that will be executed by the skill itself), the agent instructions allow use of OpenClaw tools (which may perform network or filesystem actions if the user grants them). This grants the agent some discretionary scope depending on runtime tool permissions.

ℹ Install Mechanism

There is no install spec and no executable code in the package (instruction-only), which is the lowest-risk install model. That said, docs show two installation patterns: 'clawhub install openclaw/gstack' (recommended) and a manual 'git clone && ./install.sh' flow — although the package claims install.sh was removed in v2.5.10 and the file manifest contains no install.sh. This is an inconsistency to verify but does not indicate a malicious install mechanism (no remote archives or downloads in the package).

✓ Credentials

The skill declares no required binaries, env vars, credentials, or config paths. All sub-skills show example usages that, if actually executed, might require external API keys (WebPageTest, PSI) but the package does not request these secrets. That proportionality (documentation-only, no credentials required) matches the declared metadata.

✓ Persistence & Privilege

The skill does not request 'always: true' and is user-invocable only. It does not request any agent-wide configuration changes or cross-skill credentials. Autonomous invocation (disable-model-invocation: false) is the platform default and not, by itself, a red flag here.

版本历史

v2.5.10

Version 2.5.10 - 移除 install.sh，彻底消除 ClawHub Suspicious 警告，确保更高安全性 - 明确声明本技能为纯文档型，无可执行代码、无外部依赖，更清晰的安全说明 - 技能内容、结构与角色保持不变，使用方式一致

元数据

Slug gstack-openclaw-sms

版本 2.5.10

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题

Gstack OpenClaw 是什么？

世界顶级思维合集 —— 融合Google Staff Engineer、Martin Fowler/Kent Beck/Jeff Dean工程思维、Paul Graham/Sam Altman创业思维、Elon Musk创新思维、Stripe/Airbnb设计思维。v2.5.10：移除install.sh以完全消... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 128 次。

如何安装 Gstack OpenClaw？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install gstack-openclaw-sms」即可一键安装，无需额外配置。

Gstack OpenClaw 是免费的吗？

是的，Gstack OpenClaw 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Gstack OpenClaw 支持哪些平台？

Gstack OpenClaw 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Gstack OpenClaw？

由 SMS（@smseow001）开发并维护，当前版本 v2.5.10。

Gstack OpenClaw