ast-grep
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/ast_grep_helper.pywrapper uses thesubprocessmodule to execute theast-grep(sg) binary for code analysis and transformation. It also executes platform-specific shell scripts (install.shandinstall.ps1) to manage the tool's installation and lifecycle. - [EXTERNAL_DOWNLOADS]: The installation scripts (
install.sh,install.ps1) download theast-grepbinary from GitHub's official releases when it is not found on the local system. The download targets the official repository of the project, which is a well-known service. - [SAFE]: The skill presents an indirect prompt injection surface as it ingests and processes untrusted code from the local filesystem. However, this is inherent to the tool's primary purpose as a code search and rewrite utility.
- Ingestion points:
scripts/ast_grep_helper.pysubcommands ingest files from user-defined paths. - Boundary markers: No explicit boundary markers are used when outputting search results.
- Capability inventory: The skill can read and mutate local files via the
sgbinary. - Sanitization: The helper script implements pattern validation to catch common regex-based syntax errors before execution.
Audit Metadata