Workflow & Core Tools · daymade/claude-code-skills

repomix-unmixer

Name: repomix-unmixer
Author: daymade/claude-code-skills

Extracts files from repomix-packed repositories, restoring original directory structures from XML/Markdown/JSON formats. Activates when users need to unmix repomix files, extract packed repositories, restore file structures from repomix output, or reverse the repomix packing process.

L4 High-Privilege · Graded auth & full auditV1 Commit-PinnedExecute CommandWrite FileDual-pass Audit

Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.

1How It Works & Mechanism

The implementation path is '1 pure standard library Python script + 2 format/verification reference documents' without an LLM orchestration layer: the script handles all substantive work, while SKILL.md is only responsible for triggering, parameter documentation, and operational discipline.

repomix-unmixer/SKILL.md

The script is self-contained and requires only Python 3 standard library.

A cross-check of the script's imports (re, os, sys, json, pathlib) confirms zero third-party dependencies, validating the claim.

Format detection does not rely on file extensions, but on priority-based sniffing of content feature strings: first XML (<file path= and </file>), then JSON (starts with { and contains "files"), and finally Markdown (contains '## File:').

repomix-unmixer/scripts/unmix_repomix.py

if '<file path=' in content and '</file>' in content: return 'xml' # Check for JSON format if content.strip().startswith('{') and '"files"' in content: return 'json' # Check for Markdown format if '## File:' in content: return 'markdown'

This is the entire mechanism behind 'why it can handle three formats': no schema validation, no version probing, just pure string sniffing.

XML extraction uses non-greedy DOTALL regex to match <file path>…</file> pairs, treating capture group 1 as the path and group 2 as the content—paths originate directly from file content rather than local disk traversal.

repomix-unmixer/scripts/unmix_repomix.py

file_pattern = r'<file path="([^"]+)">\n(.*?)\n</file>' matches = re.finditer(file_pattern, content, re.DOTALL)

Critical security implication: destination write paths are determined entirely by the unpacked file's content, representing this skill's sole attack surface.

Directory tree restoration is accomplished via Path(output_dir)/file_path concatenation followed by mkdir(parents=True) and per-file UTF-8 writing.

repomix-unmixer/scripts/unmix_repomix.py

full_path = Path(output_dir) / file_path full_path.parent.mkdir(parents=True, exist_ok=True) # Write the file with open(full_path, 'w', encoding='utf-8') as f: f.write(file_content)

All three formats (xml/markdown/json) share the exact same disk-writing logic, sharing identical risks.

The reliability of 'unmixing' extends only to regex boundaries: the script does not handle duplicate paths within the same file, absolute paths, out-of-bounds relative paths, or Windows backslashes, nor does SKILL.md claim to do so.

repomix-unmixer/scripts/unmix_repomix.py

def unmix_repomix(repomix_file, output_dir): """Extract files from a repomix file (auto-detects format).""" # Read the repomix file with open(repomix_file, 'r', encoding='utf-8') as f: content = f.read()

Grep across the entire script yields zero occurrences of resolve, is_relative_to, normpath, or sanitize (confirmed in a second review pass; see verification).

Operational discipline is governed by SKILL.md (extract to /tmp first, verify file counts, inspect structure with tree, avoid directly overwriting critical directories), following a design pattern of 'using documentation constraints in place of code constraints.'

repomix-unmixer/SKILL.md

### Verify Before Overwriting Never extract directly to important directories without review:

This discipline mitigates but does not eliminate path traversal risks—see security.file_writes.

2Core Capabilities

01XML format unpacking (repomix default format)

02Markdown format unpacking (## File: + fenced code blocks)

03JSON format unpacking (files[].path/content)

04Automatic format detection without requiring user declaration

05Multi-level directory structure restoration with automatic parent directory creation

06Per-file progress and total count summary output

07Specialized verification workflow tailored for Claude skills (file count/structure/YAML frontmatter/skill-creator validator)

08Quick reference guide for format specifications (three block structures for XML/Markdown/JSON + detection logic)

3External Dependencies

Kind	Dependency / Endpoint
cli	python3
cli	tree（仅用于人工检视解包结果，非脚本依赖）
cli	skill-creator 的 quick_validate.py（可选校验器，需用户本机已装 and 从 anthropics-skills 市场）

4Recommended Governance & Evidence

Suggested Controls for Safe Operation

For Agent Runtime

Graded/per-use authorization, sandbox recommended

For Administrators

Approval workflow, rollback support, full audit

Evidence & Triggers (File Paths & Excerpts)

scripts/: Execute local script or command: python3 scripts/unmix_repomix.py <repomix_file> [output_directory] (shipped with repository, standard library only)
本地工作目录: File read/write and artifact output: Writes files under output_dir after mkdir(parents=True) based on paths specified in repomix file content: full_path = Pat

Audit Notes: Rated Orange not due to network access or credential exposure (neither exists; the code level is clean), but because the chain of 'untrusted third-party content → unvalidated file path → arbitrary user-writable location' is complete and feasible: all three unpack functions write directly via Path(output_dir)/file_path, and a grep of the entire script shows zero instances of resolve, is_relative_to, normpath, or sanitize (confirmed in a second pass). The trigger condition is 'unpacking an untrusted repomix file'—the primary use case of this skill. Three mitigating factors exist: (1) the script does not execute file content; (2) both SKILL.md and README explicitly instruct unpacking to /tmp first and reviewing before moving; (3) there is no network exfiltration, and writes are strictly local. Hence it is designated Orange (use after evaluation) rather than Red: actual harm requires a user to unpack a crafted malicious bundle, and someone must subsequently consume the overwritten files. If only unpacking self-generated repomix files, the actual risk is very low. It is recommended to always unpack into a fresh empty directory and verify the path list before using the contents.

5Second-Pass Verification

[ok] 「无网络外发、无凭证读取」结论是否有反例（隐藏脚本/混淆内容/间接调用） — 目录内共 5 个文件全部读毕；脚本 import 段仅 re/os/sys/json/pathlib；全目录 token 终扫 urllib/requests/httpx/socket/subprocess/curl/wget/Authorization/token/key/secret/.env 零命中；无长混淆行；无 .skill 打包物需要与仓库比对。结论成立。
[ok] 「实现原理」是否夸大：声明支持三种格式 vs 代码实际能力 — 三种格式各有独立解析函数（unmix_xml/unmix_markdown/unmix_json）且 detect_format 会真的分派，非口头宣称。SKILL.md 的示例输出（✓ Extracted: …／✅ Successfully extracted N files!）与脚本 print 语句逐字一致。无夸大。
[discrepancy] README.md 声明的 Markdown 格式与脚本实际正则是否一致 — README「Supported Formats → Markdown Format」给出的是三级标题加四反引号围栏（### File: relative/path/to/file.ext），而脚本正则是 r'## File: ([^\n]+)\n```[^\n]*\n(.*?)\n```'（两个 #、三反引号）。'### File:' 不含子串 '## File:'（第三个字符是 # 而非空格），按 README 示例构造的输入会零提取并触发脚本的 '⚠️ No files extracted!' 退出。SKILL.md 与 references/repomix-format.md 的示例是对的（## File:），即漂移只在 README。
[unlocatable] README.md 声明的安装方式是否在仓库内可验证 — README 第 1 步要求「Download repomix-unmixer.zip」，但仓库内不存在任何 .zip/.skill 打包物（find 全仓 -name '*.skill' -o -name 'repomix-unmixer.zip' 零命中）。该 zip 是否由外部发布渠道提供，源码内无法定位，记为待补。
[discrepancy] README 声明的许可与版本是否与仓库一致 — README 写「This skill follows the same license as Claude Code」且「Version: 1.0.0 / Created: 2025-10-22」，未点名 MIT；仓库根 LICENSE 为 MIT（Copyright (c) 2025 daymade）。属表述含糊（未直接冲突，但 README 未指向仓库根 LICENSE），且 README 未记录任何后续更新日期。
[discrepancy] 写入路径是否真的无防护（安全结论的关键项，须找反例而非确认） — 反例检索失败→确认无防护：对 unmix_repomix.py grep '..|resolve|is_relative_to|abspath|normpath|startswith|sanitiz|safe' 仅命中无关行（正则里的 '<file path='、'## File:' 与 main() 的 os.path.exists 输入文件检查）。即输出目录内的路径完全未校验，第一遍判断成立并被强化。
[ok] pin commit 与 skill.path 是否与任务书一致 — git rev-parse HEAD = d5c4678cb5d4fd6acc9c922690df035dbd33d247；该目录位于仓库根，相对路径 repomix-unmixer；该目录最后一次提交为 878f947（2026-09-07），HEAD 未触及本目录。GitHub API 复核：MIT、stars 1392、pushed 2026-09-15T09:30:04Z。

6Verdict & Scenarios

Zero-dependency deterministic unpacking: Requires only python3 without installing repomix to restore XML/Markdown/JSON repomix bundles into their original directory trees, fully functional offline.

Built-in acceptance discipline rather than raw commands: Enforces a concrete verification workflow—extracting to /tmp first, counting files, checking structure with tree, spot-checking content, and running the skill-creator validator when necessary.

Fault-tolerant format sniffing: Independent of file extensions, sniffing content feature strings so repomix outputs saved under any filename can be recognized.

Dedicated verification assets for Claude skills (YAML frontmatter, asset organization, integration with skill-creator validator), integrating far more closely with the agent ecosystem than generic unpacking tools.

Best for: Suitable for: Anyone who receives a repomix-packed repository or skill bundle and wants to unpack it into a real directory tree to inspect the source code before taking action; also suitable for restoring repomix backups into working copies (SKILL.md Use Case 3). Offline, dependency-free, and single-command, making it well-suited for an agent's 'file format conversion' toolbox.

Not for: Not suitable for: Handling untrusted or malicious repomix bundles (lacks path sandboxing; see Risk #1); scenarios involving large files or embedded binary content (regex + UTF-8 processing targets text only and will corrupt embedded binaries); scenarios requiring retention of original repomix metadata (repo stats, token counts), as the script only restores path/content; and not intended for reverse operations like 'packing like repomix'.

Install Agent-Ready

① Verified Mirror 2026-09-15

Option A · Direct DownloadDownload repomix-unmixer.tar.gz

sha256: e046271700f755d1…

Option B · Copy Guide for Agent

install.json

Agents automatically download and verify mirrors from this JSON guide.

② Upstream GitHub

GitHub Repo ↗

Pinned to commit d5c4678cb5.