The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation includes instructions to install the ast-grep CLI tool via several well-known package managers.
It references @ast-grep/cli for npm, ast-grep for Homebrew, and ast-grep for Cargo.
These downloads originate from official project repositories and established, well-known registries, making them safe for environment setup.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external project source code into the agent's context through ast-grep search results, which is a standard pattern for code analysis tools.
Ingestion points: Project source files (JavaScript, Python, Go, etc.) are read by ast-grep and the matched snippets are presented to the agent, notably in files like SKILL.md and references/workflows.md.
Boundary markers: The skill does not provide specific instructions to the agent to treat ast-grep output as untrusted or to wrap it in protective delimiters.
Capability inventory: The skill uses the Bash, Read, Edit, and Task tools, allowing the agent to execute commands and modify the filesystem based on findings.
Sanitization: Code matched by the tool is returned as raw text or JSON without sanitization. While this creates a potential surface for indirect injection, it is the primary intended function of the tool and is assessed as a low-risk, expected behavior for developer-focused skills.

code-symbols