Install
$ agentstack add skill-poteto-noodle-ast-grep ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
ast-grep
Workflow
- Write a test snippet representing the target code
- Write the rule (start with
pattern, escalate tokind+has/insideif needed) - Test with
--stdinbefore searching the codebase - Search the codebase once the rule matches
Critical Gotchas
Always use stopBy: end on relational rules
Without it, has/inside stop at the first non-matching node instead of traversing the full subtree:
# WRONG — will miss deeply nested matches
has:
pattern: await $EXPR
# RIGHT
has:
pattern: await $EXPR
stopBy: end
Escape metavariables in shell
$VAR gets interpreted by the shell. Either escape or single-quote:
# Double-quoted: escape with backslash
ast-grep scan --inline-rules "id: test
language: javascript
rule:
pattern: await \$EXPR" .
# Single-quoted: no escaping needed
ast-grep scan --inline-rules 'id: test
language: javascript
rule:
pattern: await $EXPR' .
Metavariables must be the sole content of an AST node
These don't work: obj.on$EVENT, "Hello $WORLD", a $OP b, $jq
Use $$OP for unnamed nodes (operators, punctuation). Use $$$ARGS for zero-or-more nodes.
Testing with --stdin
echo "async function test() { await fetch(); }" | ast-grep scan --inline-rules 'id: test
language: javascript
rule:
kind: function_declaration
has:
pattern: await $EXPR
stopBy: end' --stdin
Debugging with --debug-query
When rules don't match, inspect the AST to find correct kind values:
ast-grep run --pattern 'your code here' --lang javascript --debug-query=cst
Formats: cst (all nodes), ast (named only), pattern (how ast-grep sees your pattern).
Rule syntax
See references/rule_reference.md for the full rule reference (atomic, relational, composite rules, and metavariables).
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: poteto
- Source: poteto/noodle
- License: MIT
- Homepage: https://poteto.github.io/noodle/
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.