ast-grep
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes
install.shandinstall.ps1scripts that download theast-grepbinary from its official GitHub repository (github.com/ast-grep/ast-grep). This is a necessary and transparent operation for the skill to function, targeting the official release assets of the tool being wrapped. - [COMMAND_EXECUTION]: The core functionality resides in
scripts/ast_grep_helper.py, which executes theast-grepbinary usingsubprocess.run. Arguments are handled securely as a list to prevent shell injection, and the tool's execution is restricted to the intended purpose of code analysis and modification. - [PROMPT_INJECTION]: The skill's instructions in
SKILL.mdare focused on technical guidance for structural search and rewrite tasks. No patterns aimed at overriding agent safety guidelines or hijacking behavior were detected.
Audit Metadata