The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes installation scripts (install.sh and install.ps1) that download the ast-grep binary from its official repository on GitHub (github.com/ast-grep/ast-grep). These downloads target a well-known service and organization.
[COMMAND_EXECUTION]: The Python helper script (scripts/ast_grep_helper.py) executes the ast-grep binary using subprocess.run. The command is passed as a list, and the script includes logic to resolve the binary path across different environments (cached local binary, PATH, OMO runtime, or Homebrew).
[INDIRECT_PROMPT_INJECTION]: The skill processes external code files, which constitutes a potential attack surface for indirect prompt injection. However, the skill implements a mandatory evidence chain for safety: it identifies ingestion points via the paths argument, performs offline validation of patterns to catch common errors or injections, and limits its capabilities to AST-aware code transformations.

ast-grep