ast-grep
Warn
Audited by Snyk on Jul 9, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The install scripts and README include runtime fetches of remote release artifacts (e.g. git clone https://github.com/code-yeongyu/ast-grep-skill and downloads from https://github.com/ast-grep/ast-grep/releases/download/...), which the skill's installer (install.sh / install.ps1) runs to retrieve and install executable binaries that will be executed locally.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata