Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mishahanin/heading-os --skill ast-grepgit clone --depth 1 https://github.com/mishahanin/heading-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mishahanin/heading-os/ast-grep)<a href="https://agentmods.dev/skills/mishahanin/heading-os/ast-grep"><img src="https://agentmods.dev/badge/skills/mishahanin/heading-os/ast-grep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mishahanin/heading-os/ast-grep"><img src="https://agentmods.dev/badge/skills/mishahanin/heading-os/ast-grep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.02105 |
| Opus 5 | $0.00040 | $0.01052 |
| Sonnet 5 | $0.00016 | $0.00421 |
| Haiku 4.5 | $0.00008 | $0.00211 |
Grade A, and why
ast-grep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 218 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ast-grep Code Search
Adapted from upstream ast-grep/agent-skill. Workspace-customized frontmatter; body refactored 2026-06-16 (CLI catalog split to
references/cli-cookbook.md, voice/never sections added).
Overview
This skill helps translate natural language queries into ast-grep rules for structural code search. The ast-grep tool uses Abstract Syntax Tree (AST) patterns to match code by its structure rather than its text. This makes code search precise across large codebases.
When to Use This Skill
Use this skill when users:
- Need to search for code patterns using structural matching (e.g., "find all async functions that don't have error handling")
- Want to locate specific language constructs (e.g., "find all function calls with specific parameters")
- Request searches that require understanding code structure rather than just text
- Ask to search for code with particular AST characteristics
- Need to perform complex code queries that traditional text search cannot handle
Step 0: Check the binary before anything else
Run this first, every time:
command -v ast-grep
If it prints nothing, ast-grep is not installed. Say so and stop. Tell the
operator to install it, then wait. Do not draft a rule, and do not write a test
file. Every command below fails without the binary.
Never accept sg as proof that ast-grep is present. Upstream ships sg as
a short alias, but on Ubuntu /usr/bin/sg is a different program from the
login package. It runs a command under another group ID, through /bin/sh.
MEASURED on this machine 2026-09-02: ast-grep was absent while command -v sg
still resolved. A check written against sg therefore reports a healthy
install. Every command after it then fails.
The same confusion reached the tool grant. This skill's allowed-tools carried
Bash(sg:*) until 2026-09-02. A grant is a grant and never a limit, so that
line permitted sg <group> -c "<any command>", which is a general command
runner. Nothing in this skill or its two reference files ever invoked sg, so
the grant bought nothing. It is removed. Do not put it back.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +25 lines abe6872a371b
- 10d ago First seen · 193 lines · 80 tokens per session scan A a9e0262b6e5a
ast-grep is a skill published in the GitHub repository mishahanin/heading-os (11 stars, last pushed yesterday), licensed Apache-2.0. It adds 80 tokens to every session and 2,105 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
node-inspect-debugger
Debug Node.js via --inspect + Chrome DevTools Protocol CLI.
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
inspecting-hermes-desktop-dom
Read the live Hermes desktop DOM/CSS over CDP.
agent-introspection-debugging
Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports. Use when an agent run fails and you need a reproducible diagnosis instead of a retry.
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
python-debugpy
Debug Python: pdb REPL + debugpy remote (DAP).