skills.rest
h102-log
h102-logCOMMUNITY
Explore all skills by this author →
GitHub

moai-tool-ast-grep

Performs AST-based structural code search, security scanning, and refactoring across 40+ languages.

Updated Jun 18, 2026
Search Tags:#static analysis#refactoring#code search#security scanning#structural search#ast-grep#codemod
One-click install
npx skills add https://github.com/h102-log/pdfrag --skill moai-tool-ast-grep-h102-log
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: moai-tool-ast-grep
Source: https://github.com/h102-log/pdfrag/tree/main/.claude/skills/moai-tool-ast-grep
Command: npx skills add https://github.com/h102-log/pdfrag --skill moai-tool-ast-grep-h102-log

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ast-grep, and includes references (resource) components.

What problem does it solve? Regex and text-based search cannot reliably match code structure, producing false positives and missing nested patterns when refactoring, auditing security, or migrating APIs across large codebases. ## Core Features & Use Cases - Structural Pattern Search: Match code by AST structure using meta-variables like $VAR and $$$ARGS instead of fragile regular expressions. - Security Scanning: Detect SQL injection, XSS, hardcoded credentials, and command injection with prebuilt YAML rules mapped to OWASP Top 10. - Codemod Transformations: Rewrite code across files with pattern-to-fix rules for API migrations, deprecations, and modernization. - Use Case: A team migrating from axios to fetch can define a YAML rule matching axios.get($URL), preview changes with a dry run, and apply the rewrite across the entire TypeScript codebase in one command. ## Quick Start Ask the AI to find all console.log calls in the src directory using ast-grep structural pattern matching.

Frequently Asked Questions about moai-tool-ast-grep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search code by AST structure instead of regex?▼

Use ast-grep's sg run command with a pattern containing meta-variables, such as sg run --pattern 'console.log($MSG)' --lang javascript. The pattern matches AST nodes structurally, so it finds semantically equivalent code regardless of formatting or whitespace.

How to detect SQL injection with ast-grep rules?▼

Define a YAML rule matching dangerous patterns like cursor.execute with string formatting or f-strings, then run sg scan with your sgconfig.yml. The skill includes prebuilt rules for SQL injection, XSS, hardcoded secrets, and command injection across Python, JavaScript, and TypeScript.

What languages does ast-grep support?▼

ast-grep supports over 40 languages including Python, JavaScript, TypeScript, Go, Rust, Java, Kotlin, C, C++, C#, Swift, Ruby, PHP, Scala, Elixir, Lua, HTML, Vue, and Svelte. Language is auto-detected from file extension or set explicitly with the --lang flag.

When should I use ast-grep instead of grep or ripgrep?▼

Use ast-grep when matching code structure matters, such as finding nested function calls, class hierarchies, or refactoring across files. Use plain grep for simple literal text search, since ast-grep requires parsing overhead that is unnecessary for non-structural queries.

Can ast-grep rewrite code automatically?▼

Yes, sg run with the --rewrite flag transforms matched patterns, and YAML rules with a fix field apply changes during sg scan. Use --dry-run to preview changes and --interactive to confirm each edit before applying.

How do I integrate ast-grep scanning into CI/CD?▼

Run sg scan with your sgconfig.yml and output results as JSON or SARIF for GitHub Actions, GitLab CI, or Jenkins. The skill includes workflow examples for pre-commit hooks, pull request scanning, and SARIF upload to GitHub Security.

Related Skills

Explore More Software Engineering Skills→
microsoftmicrosoft
18

shadow-frog-init

Initialize a shadow knowledge base mirroring source trees with markdown files.

Official
Advanced
sarkarshivaditya-labsarkarshivaditya-lab

apply-all-findings

Implements every code review finding or creates GitHub tracking issues for deferred items.

Community
Intermediate
xvawlxvawl
1

pre-merge-checklist

Validate Python and TypeScript PRs against linting, typing, tests, and documentation.

Community
Intermediate
barkleesandersbarkleesanders
5

file-search

Search codebases for text patterns and syntax-aware structural code patterns.

Community
Intermediate