Workflow & Core Tools · daymade/claude-code-skills
repomix-safe-mixer
Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.
L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandNetwork AccessWrite FileDual-pass Audit
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.
1How It Works & Mechanism
Orchestration follows a 'subprocess + JSON contract' pattern: safe_pack.py does not import the scanner directly. Instead, it invokes scan_secrets.py in the same directory via subprocess with --json, parsing its stdout to decide whether to proceed with packaging.
repomix-safe-mixer/scripts/safe_pack.py
cmd = [sys.executable, str(scan_script), str(directory), '--json']
What is happening here: The two scripts are decoupled into a 'scanner (a pure functional CLI with JSON and exit code contracts) + orchestrator'. This enables the scanner to be used independently for pre-commit hooks or cleanup verification, while decoupling the orchestrator from the scanner's internal implementation details.
Detection capabilities stem from a 13-item regex dictionary (SECRET_PATTERNS). All checks are single-line regex matches without AST parsing, entropy analysis, or machine learning.
repomix-safe-mixer/scripts/scan_secrets.py
'aws_access_key': r'(?i)AKIA[0-9A-Z]{16}', 'aws_secret_key': r'(?i)(?:aws_secret|aws.{0,20}secret).{0,20}[=:]\s*["\']?([0-9a-zA-Z/+=]{40})["\']?', 'supabase_url': r'https://[a-z]{20}\.supabase\.co', 'supabase_anon_key': r'eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*', 'stripe_key': r'(?:sk|pk)_(live|test)_[0-9a-zA-Z]{24,}',
What is happening here: Relying on regex instead of semantic analysis yields fully transparent, auditable rules with zero dependencies that can run offline. The tradeoff is that it only recognizes credentials that 'look like' known patterns (see items 4 and 6 in verification for false negative blind spots).
The scan scope is defined by a dual constraint: an 'extension allowlist + .env filename exception'. Code comments explicitly clarify why an exception is required for dotenv files (Path('.env').suffix == '').
repomix-safe-mixer/scripts/scan_secrets.py
# Full filenames that must be scanned regardless of Path.suffix. Dotenv # files break suffix matching: Path('.env').suffix == '' and # Path('.env.local').suffix == '.local', so scanning by extension alone # silently skips the most common places secrets end up. SCANNABLE_FILENAMES = { '.env',
What is happening here: The most common location for secrets (the .env family) is hardcoded into the scanning surface. This prevents files that need inspection the most from being missed due to extension-only matching—representing the only counterfactual-reasoning design choice in this script.
Skipped directories are defined as a hardcoded set (15 directories including node_modules, .git, .venv, dist, build, etc.) without parsing .gitignore.
repomix-safe-mixer/scripts/scan_secrets.py
SKIP_DIRS = { 'node_modules', '.git', '.venv', 'venv', '__pycache__', 'dist', 'build',
What is happening here: Limits scanning overhead and noise. The tradeoff is that credentials hidden inside ignored directories will not be reported, and --exclude can only append to, rather than remove from, these default skip entries.
False positive suppression relies on two strict rules: hits matching placeholder wordlists are skipped, and a substring check is evaluated against the entire line (if words like 'example' or 'test-' appear anywhere in the line, all hits on that line are discarded).
repomix-safe-mixer/scripts/scan_secrets.py
placeholders = [ 'your-', 'example', 'placeholder', 'xxx', 'yyy', 'zzz', 'test-', 'demo-', 'sample-', '<YOUR_', '${', 'TODO' ]
What is happening here: Reduces placeholder false positives. However, because it evaluates line_lower rather than the specific match, a line containing both a real secret and the word 'example' will be entirely ignored, resulting in a suppression scope broader than the 'skip test/example/sample files' stated in SKILL.md.
Comment lines are skipped unconditionally (starting with //, #, /*, or *).
repomix-safe-mixer/scripts/scan_secrets.py
if re.search(r'^\s*(?://|#|/\*|\*)', line):
What is happening here: Assumes that comments contain only examples. A side effect is that commented-out real credentials (often left behind during debugging) are omitted from the report.
Defaults to fail-closed: detection immediately aborts packaging with exit 1, and execution proceeds only when explicitly passed --force; the --force path still emits a warning.
repomix-safe-mixer/scripts/safe_pack.py
print("❌ Cannot pack: Secrets detected!")
What is happening here: Converts the 'security scan' from an advisory recommendation into a blocking gate. This matches the SKILL.md guarantee ('3. Blocks packaging if secrets found') directly in code (the only exceptions being --force and the empty stdout failure path detailed below).
Packaging is executed by calling the external repomix CLI: the target directory is set as cwd, --config/--output arguments are passed through, and repomix writes the artifacts to disk.
repomix-safe-mixer/scripts/safe_pack.py
result = subprocess.run(cmd, cwd=directory, capture_output=True, text=True)
What is happening here: This skill does not implement packaging itself; it merely orchestrates a 'scan first, pack later' sequence. repomix is invoked as an argv list (without shell=True), preventing directory paths from leading to command injection.
The report echoes matched secret snippets and context lines to stdout (in --json mode, match is truncated to 50 characters and context to 100 characters; human-readable reports print the first 80 characters of match/context), but the script itself writes no files.
repomix-safe-mixer/scripts/scan_secrets.py
print(f" Match: {finding.matched_text[:80]}") print(f" Context: {finding.line_content[:80]}")
What is happening here: Allows users to locate the exact file and line number. A side effect is that plaintext secret snippets enter terminal output—in agent sessions, this output enters the model context and chat history, sitting in a grey zone of 'not transmitted externally, but not silent either'.
Exit codes serve as the interface: returns 1 when matches are found and 0 when clean. SKILL.md explicitly suggests using it as a pre-commit hook (to block commits).
repomix-safe-mixer/scripts/scan_secrets.py
sys.exit(1 if findings else 0)
What is happening here: Allows the scanner to integrate cleanly into CI or git hooks. Note, however, that safe_pack.py does not check the process returncode when calling it, only verifying whether stdout parses as valid JSON (see item 3 in verification regarding fail-open risk).
2Core Capabilities
01Pre-packaging secret scanning: Credential detection across 12 rule categories (AWS access keys/secrets, Supabase URLs and anon keys/JWTs, Stripe, Cloudflare tokens, R2 account IDs, Turnstile, OAuth secrets, private key blocks, generic API keys)
02Blocks packaging upon detection (fail-closed, exit code 1) and provides a remediation checklist
03Controlled override: --force bypasses blocking while retaining warnings (explicitly marked NOT RECOMMENDED in documentation)
04Standalone scanner use cases: post-cleanup reverification, pre-commit hooks, legacy code auditing (--json for programmatic consumption)
05Findings grouped by type (displays only the first 3 items per category, collapsing the rest with a count)
06repomix packaging orchestration: passes through --config / --output and executes within the target directory
07False positive suppression: placeholder wordlists, comment lines, and example/test files (extensible via --exclude)
08Credential remediation patterns and post-leak procedures (env variable substitution -> .env.example -> reverification -> packaging; rotate/revoke/audit/monitor after exposure)
3External Dependencies
| Kind | Dependency / Endpoint |
|---|---|
| cli | repomix（第三方打包 CLI，需用户自行预装） |
| cli | python3（sys.executable 拉起同目录扫描器；仅标准库 os/re/sys/json/subprocess/pathlib） |
| package | repomix（npm 生态包，本 skill 只调用命令，不负责安装） |
4Recommended Governance & Evidence
Suggested Controls for Safe Operation
For Agent Runtime
Graded/per-use authorization, sandbox recommended
For Administrators
Approval workflow, rollback support, full audit
Evidence & Triggers (File Paths & Excerpts)
- scripts/: Executing local scripts or commands: python3 scripts/safe_pack.py <directory> [--output file.xml] [--config repo
- 环境变量 / API Key: Reading vendor service credentials: Designed to read file contents within the target directory for regex matching, including .env/.env.example/.env.local/.env.production/.env.de
- 本地工作目录: File I/O and artifact generation: Zero file writes from both scripts themselves (no open(...,'w'), no temp files, no log files)
Audit Notes: Behavioral profile: Two standard-library local scripts with zero network calls (no requests/urllib/socket/http/curl/wget; all https:// links in SKILL.md are placeholders or external reference URLs) and zero credential exfiltration. Reading files within the target directory (including the .env family) is a prerequisite for scanning functionality, and match results are printed to stdout without touching disk. Only invokes local CLIs (repomix is a required pre-installed third-party npm command invoked as an argv list without shell injection surfaces). Caveats: (1) Matched snippets and raw context lines are echoed to stdout, entering the model context and conversation history during agent sessions; this introduces two security concerns for untrusted repositories: prompt injection via report text and credential footprint retention. (2) The orchestrator does not check the scanner subprocess exit code; if stdout is empty, it fails open and proceeds directly with packaging. This creates an implementation gap against the strong 'Blocks packaging if secrets found' guarantee in SKILL.md, and validating the exit code alongside stdout is recommended in CI.
5Second-Pass Verification
- [ok] 外部依赖调用点反查（repomix / python3） — 全目录 grep subprocess 仅 3 处命中：safe_pack.py 的 import、L24 subprocess.run（调 scan_secrets.py，cmd 来自 cmd = [sys.executable, str(scan_script), …]）、L74 subprocess.run(cmd, cwd=directory)（cmd 起点为 cmd = ['repomix']）。两个依赖条目均有真实调用点，无第三处。
- [ok] 网络外发反例查找 — grep requests|urllib|urlopen|socket|http|curl|wget 在两个脚本内零命中；SKILL.md 与 common_secrets.md 中的 https:// 全部是占位符（https://your-project-ref.supabase.co）、示例域名（.r2.cloudflarestorage.com 出现在正则 lookahead 文本中）或文档外链。无 DNS/HTTP 客户端、无遥测、无任何外发路径。
- [discrepancy] 扫描器返回码未被校验 → fail-open 反例 — run_secret_scan 只做 result = subprocess.run(...)；随后 findings = json.loads(result.stdout) if result.stdout.strip() else []，从不检查 result.returncode。若扫描器因解释器缺失/脚本损坏/进程被杀而 stdout 为空，findings 被判为空列表，main 直接进入 '📦 Packing … with repomix' 分支——即『扫描失败』被当成『无密钥』。这与 SKILL.md『3. Blocks packaging if secrets found』的强承诺存在实现缺口：只承诺了『发现密钥时阻断』，未覆盖『扫描本身失败』。
- [discrepancy] SKILL.md 检测类型清单 vs SECRET_PATTERNS 实际键 — SKILL.md 列出 11 类（AWS Access Keys、R2 Account IDs/Access Keys、Supabase URL/Anon Keys、Stripe、OpenAI sk-、Google Gemini AIza、Generic API Keys、JWT、OAuth Client Secrets、Private Keys、Turnstile）。代码 SECRET_PATTERNS 实为 12 个键，但其中：无 R2 Access Keys 专用规则；无 Google Gemini（AIza…）规则（全目录 grep 'AIza' 零命中）；OpenAI sk- 仅在同时出现 api_key/apikey 字样时可被 generic_api_key 捕获，stripe_key 只认 sk_live/sk_test 形式，因此裸的 sk-proj-… 赋值不一定会命中。文档检测类型清单宽于代码能力。
- [discrepancy] 假阳性抑制范围 vs 文档描述 — SKILL.md『Common False Positives』写的是跳过占位符、『Files matching .*test.*, .*example.*, .*sample.*』的文件与注释行。should_skip_match 实际对整行做 substring 包含判断（placeholder in line_lower），且注释判定用 ^\s*(?://|#|/\*|\*)——即抑制粒度是『行』而非『match』或『文件』：真密钥与 'example' 同行即被放过，被注释掉的真实凭证亦不上报。代码抑制面大于文档描述，属漏报向的偏差。
- [discrepancy] 扫描面缺口：不在白名单的高风险文件类型 — SCANNABLE_EXTENSIONS 只含 .ts/.tsx/.js/.jsx/.py/.md/.json/.yaml/.yml/.sh/.bash/.zsh/.sql/.go/.java/.rb/.php/.cs，SCANNABLE_FILENAMES 只补 7 个 dotenv 名。因此 *.pem、*.key、id_rsa、*.ppk、*.p12、*.crt、.envrc、*.toml/*.ini/*.conf/*.properties/*.xml 都不被扫描——private_key 规则（-----BEGIN … PRIVATE KEY-----）写好了却基本没有机会命中这些最常见的私钥载体。SKILL.md 未提示该覆盖边界（仅笼统说 may not catch all credential types）。
- [discrepancy] --force 语义与文档措辞一致性 — SKILL.md 标题写『**Force pack (dangerous, skip scan)**』，暗示跳过扫描；safe_pack.py 中 force = '--force' in sys.argv 之后仍照常执行 run_secret_scan 与 print_findings_report，只是跳过阻断并打印『WARNING: --force flag set, packing anyway despite secrets found!』。实际语义是『扫描照做、仅放行』，措辞『skip scan』不准确。
- [ok] 证据是否指向被扫文件内容/是否落盘 — 两脚本无 open(...,'w')、无 tempfile、无日志写入；匹配结果只经 print/ json.dumps 到 stdout（scan_secrets 的 to_dict 将 match 截断 50、context 截断 100；人类可读报告打印前 80 字符）。『不落盘、不外发』成立；但『不进日志』不成立——终端输出在 agent 会话中会被留存为上下文。
6Verdict & Scenarios
Best for: Best suited for: A final self-check before packaging a local codebase into a repomix archive for external sharing; introducing a zero-dependency secret scan with exit-code-based gating into CI/pre-commit pipelines; or leveraging a readable, editable regex rule table to expand detection for custom tech stacks (such as adding AIza or .pem rules). A typical workflow is running `scan_secrets.py . --json` in CI to block commits, or running `safe_pack.py <dir>` before sharing to enforce 'package only if the scan passes'.
Not for: Not suited for: Scenarios where entire security guarantees are offloaded to this tool—it relies on pattern matching rather than comprehensive secret scanning, carries clear blind spots, and cannot replace gitleaks, trufflehog, CI platform secret scanning, or git history sanitization (as explicitly stated in SKILL.md itself); scanning repositories consisting primarily of private key files (*.pem/id_rsa are outside the scan scope); running directly inside agent sessions on untrusted repositories (reports echo repository text back into the context); or workflows expecting 'automated credential removal'—the phrase 'removing hardcoded credentials' in official descriptions actually entails manual fixes based on the report, as the scripts only handle detection and blocking.
Install Agent-Ready
① Verified Mirror 2026-09-15
Option A · Direct DownloadDownload repomix-safe-mixer.tar.gz
sha256:
Option B · Copy Guide for Agent7847e6113e529f6b…Agents automatically download and verify mirrors from this JSON guide.
② Upstream GitHub
GitHub Repo ↗
Pinned to commit d5c4678cb5.