Install
$ agentstack add skill-fmind-dot-ast-grep ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
ast-grep
Structural code search and rewrite: a pattern is real code with meta-variables, matched against the syntax tree. A call-expression pattern distinguishes a call from similar text inside a string or comment; string and comment nodes can also be matched deliberately. Use it where rg gives false positives; plain text search stays with rg.
Commands
ast-grep run -p 'print($$$ARGS)' -l python # search; run is the default subcommand
ast-grep run -p 'print($$$ARGS)' -r 'logger.info($$$ARGS)' -l python # dry run: prints the diff, changes nothing
ast-grep run -p 'print($$$ARGS)' -r 'logger.info($$$ARGS)' -l python --update-all # apply after reviewing the dry run (-i to confirm per hunk)
ast-grep run -p 'os.getenv($KEY)' -l python --json=compact # structured output; --json=stream gives one object per line
ast-grep scan # every rule in sgconfig.yml
ast-grep scan -r rules/no-print.yml --format github # one rule file; GitHub annotations in CI
Workflow
- Write the pattern as code:
$NAMEmatches one node,$$$NAMEa sequence (arguments, statements),$_a node without binding; always pass-lso the pattern parses in the right grammar, and use--debug-query=astwhen a pattern that should match does not. - Search first: run without
-r, read the matches with-C 2for context, and tune--globsor--no-ignorewhen files are skipped. - Rewrite in two steps: add
-rto see the diff, then--update-all(or-ifor an interactive session); captured meta-variables are reused in the replacement. - Promote to a rule: for a lint or a repeated refactor,
ast-grep new projectscaffoldssgconfig.ymlandrules/; a rule file hasid,language,rule(pattern,kind,inside,has,not), optionalfix,severity, andmessage;ast-grep testruns itsvalidandinvalidcases. - Wire into the gate: run
ast-grep scaninsidecheck:lint(see [mise](../mise/SKILL.md)) so hooks and CI apply the same rules.
Gotchas
- Meta-variables are uppercase:
$ais plain text;$A,$ARGS,$_are meta-variables. - Pattern must be a complete node:
foo(does not parse; matchfoo($$$)and narrow with--selector. - Rewrite scope:
-rreplaces the whole matched node, not a substring inside it. - Syntax is not name resolution: inspect imports, aliases, and shadowed names before rewriting; identical syntax can refer to different functions.
- Language id: pass
-l pythonfor inline patterns; underscan, the.pyextension selects the grammar.
Official Skills
Upstream: ast-grep/agent-skill; follow the shared [vendor-skill policy](../agent-project/references/vendor-skills.md) and select the structural-search guidance.
Documentation
- ast-grep guide · Pattern syntax · Rule reference · Languages
- Releases: ast-grep · changelog
- Companion skills: [repository-maintenance](../repository-maintenance/SKILL.md) (repository simplification), [python-stack](../python-stack/references/foundation/GUIDE.md) (Python quality gate).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.