Skills Explorer Add Skills

repomix-safe-mixer

An agent skill by daymade, from daymade/claude-code-skills. Tags: cleanup, code, documents, packaging, security.

What it does

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill repomix-safe-mixer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/repomix-safe-mixer ~/.claude/skills/repomix-safe-mixer

Safety box score

Grade C, moderate risk: 30 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill scans a user-supplied codebase for credential patterns and then shells out to `repomix` to package it. The main risks are local secret exposure in scan output, reading `.env*` and similar sensitive files, and the ability to bypass the safety gate or write the package to an arbitrary writable location.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)`scripts/safe_pack.py` and `scripts/scan_secrets.py` both invoke external commands with `subprocess.run(...)`, including `repomix` from PATH.
Network access0 (none)The shipped scripts do not download from or send data to remote hosts; they only read local files and run local commands.
Filesystem reach2 (moderate)The scanner recursively reads a user-chosen directory and explicitly includes `.env`, `.env.local`, and similar files; `--output` is passed through directly to `repomix`, so the package can be written anywhere writable.
Secrets & credentials2 (moderate)This skill is purpose-built to inspect secret-bearing files and it prints matches and context, so discovered credentials can be exposed in terminal logs.
Privilege & persistence0 (none)There is no sudo use, service registration, shell startup editing, or other privilege-changing behavior.
Instruction hijack surface1 (low)The `--force` option explicitly skips the scan gate and continues "packing anyway despite secrets found", which is a safety bypass.
Irreversible actions0 (none)It does not push, deploy, post, pay, book, or delete anything; it only scans and packages locally.
Transparency0 (none)All shipped logic is readable Python/Markdown; there are no binaries, decoded blobs, or unpinned remote installs.

Before installing

Rated 2026-10-20 by an automated review of 4 files from the skill's repository.

Source

Repository
daymade/claude-code-skills (all skills from this repository)
Path
repomix-safe-mixer/SKILL.md
Branch
main
Updated
2026-09-20