skills.rest
yekinya
yekinyaCOMMUNITY
Explore all skills by this author →
GitHub

moai-tool-ast-grep

Perform structural code search, security scanning, and codemod transformations using ast-grep across 40+ languages.

2|Updated May 27, 2026
Search Tags:#static analysis#refactoring#code search#security scanning#structural search#ast-grep#codemod
One-click install
npx skills add https://github.com/yekinya/moai-novel --skill moai-tool-ast-grep-yekinya
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: moai-tool-ast-grep
Source: https://github.com/yekinya/moai-novel/tree/main/moai-novel/.claude/skills/moai-tool-ast-grep
Command: npx skills add https://github.com/yekinya/moai-novel --skill moai-tool-ast-grep-yekinya

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ast-grep, @ast-grep/cli, and includes references (resource) components.

What problem does it solve? Regex-based search matches text, not code structure, producing false positives and missing semantic patterns. This Skill enables AST-aware code search, security vulnerability scanning, and large-scale refactoring that understands syntax across 40+ programming languages. ## Core Features & Use Cases - Structural Pattern Search: Find code patterns using AST meta-variables like $VAR and $$$ARGS instead of fragile regex, covering nested calls, class hierarchies, and import dependencies. - Security Scanning: Detect SQL injection, XSS, hardcoded credentials, command injection, and other OWASP Top 10 vulnerabilities with YAML rules and sgconfig.yml. - Codemod Transformations: Rewrite code at scale with pattern-to-pattern fixes, such as migrating axios to fetch or converting var to const, with dry-run preview support. - Use Case: Rename a deprecated function across hundreds of files by running sg with a pattern and rewrite rule, previewing changes with dry-run before applying. ## Quick Start Ask the AI to find all console.log calls in your JavaScript source directory using an ast-grep structural pattern.

Frequently Asked Questions about moai-tool-ast-grep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I search code structurally with ast-grep?▼

Run sg with the pattern option specifying an AST pattern like console.log($MSG), the lang option for the language, and the target directory. Meta-variables like $VAR capture single nodes and $$$ARGS capture multiple nodes.

How do I detect SQL injection with ast-grep rules?▼

Create a YAML rule matching dangerous patterns like cursor.execute with string formatting or concatenation, set severity to error, and run sg scan with your sgconfig.yml. The rule can include a fix suggesting parameterized queries.

What is the difference between ast-grep and regex search?▼

ast-grep matches code by AST structure, so it ignores comments, strings, and naming coincidences that regex matches. This reduces false positives significantly and enables semantic transformations that text replacement cannot safely perform.

Which languages does ast-grep support?▼

ast-grep supports over 40 languages including Python, JavaScript, TypeScript, Go, Rust, Java, Kotlin, C, C++, Ruby, Swift, C#, PHP, Scala, Elixir, Lua, HTML, Vue, and Svelte. Language is auto-detected from file extension or set with the lang flag.

How do I preview ast-grep codemod changes before applying?▼

Run sg with your pattern and rewrite options plus the dry-run flag to preview all changes without modifying files. Review the diff output, validate the pattern on representative files, then apply and run your test suite to verify.

Related Skills

Explore More Software Engineering Skills→
modu-aimodu-ai
67

moai-tool-ast-grep

Search, scan, and refactor code across 40+ languages using ast-grep CLI.

Official
Advanced
AidenSbVevoAidenSbVevo
1

sarif-parsing

Process and analyze SARIF 2.1.0 static analysis results to identify and deduplicate security vulnerabilities.

Community
Advanced
seo-jinseokseo-jinseok

moai-foundation-quality

Enforce TRUST 5 validation and code quality gates across multiple languages.

Community
Advanced
pax-kpax-k
3

architecture-boundary-enforcer

Enforce and document architecture boundaries using dependency-cruiser, ESLint, import-linter, and custom scripts.

Community
Advanced