structural-search
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a configuration and reference guide for the ast-grep (sg) command-line utility. All provided examples and reference files are consistent with the legitimate goal of structural code analysis.
- [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands using sg and pipes them with standard utilities like jq, fzf, and fd. These are standard developer workflows for searching and processing code.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by ingesting external code for analysis. 1. Ingestion points: Local source code files parsed by ast-grep in various languages (JS, Python, Go, Rust). 2. Boundary markers: Absent; the tool operates directly on file content via shell commands. 3. Capability inventory: The skill uses the Bash tool to execute sg, which can read files and perform in-place rewrites. 4. Sanitization: None; the tool processes raw AST nodes. As the skill is intended for code auditing, this behavior is expected and the associated risk is low.
Audit Metadata