- Installs
- 914
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/daymade/claude-code-skills --skill repomix-safe-mixer- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads repomix-safe-mixer automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Repomix Safe Mixer
Overview
Safely package codebases with repomix by automatically detecting and removing hardcoded credentials.
This skill prevents accidental credential exposure when packaging code with repomix. It scans for hardcoded secrets (API keys, database credentials, tokens), reports findings, and ensures safe packaging.
When to use: When packaging code with repomix for distribution, creating shareable reference packages, or whenever security concerns exist about hardcoded credentials in code.
Core Workflow
Standard Safe Packaging
Use safe_pack.py from this skill's scripts/ directory for the complete workflow: scan → report → pack.
python3 scripts/safe_pack.py <directory>
What it does:
- Scans directory for hardcoded credentials
- Reports findings with file/line details
- Blocks packaging if secrets found
- Packs with repomix only if scan is clean
Example:
python3 scripts/safe_pack.py ./my-project
Output if clean:
🔍 Scanning ./my-project for hardcoded secrets...
✅ No secrets detected!
📦 Packing ./my-project with repomix...
✅ Packaging complete!
Package is safe to distribute.
Output if secrets found:
🔍 Scanning ./my-project for hardcoded secrets...
⚠️ Security Scan Found 3 Potential Secrets:
🔴 supabase_url: 1 instance(s)
- src/client.ts:5
Match: https://your-project-ref.supabase.co
❌ Cannot pack: Secrets detected!
Options
Custom output file:
python3 scripts/safe_pack.py \
./my-project \
--output package.xml
With repomix config:
python3 scripts/safe_pack.py \
./my-project \
--config repomix.config.json
Exclude patterns from scanning:
python3 scripts/safe_pack.py \
./my-project \
--exclude '.*test.*' '.*\.example'
Force pack (dangerous, skip scan):
python3 scripts/safe_pack.py \
./my-project \
--force # ⚠️ NOT RECOMMENDED
Standalone Secret Scanning
Use scan_secrets.py from this skill's scripts/ directory for scanning only (without packing).
python3 scripts/scan_secrets.py <directory>
Use cases:
- Verify cleanup after removing credentials
- Pre-commit security checks
- Audit existing codebases
Example:
python3 scripts/scan_secrets.py ./my-project
JSON output for programmatic use:
python3 scripts/scan_secrets.py \
./my-project \
--json
Exclude patterns:
python3 scripts/scan_secrets.py \
./my-project \
--exclude '.*test.*' '.*example.*' '.*SECURITY_AUDIT\.md'
Detected Secret Types
The scanner detects common credential patterns including:
Cloud Providers:
- AWS Access Keys (
AKIA...) - Cloudflare R2 Account IDs and Access Keys
- Supabase Project URLs and Anon Keys
API Keys:
- Stripe Keys (
sk_live_...,pk_live_...) - OpenAI API Keys (
sk-...) - Google Gemini API Keys (
AIza...) - Generic API Keys
Authentication:
- JWT Tokens (
eyJ...) - OAuth Client Secrets
- Private Keys (
-----BEGIN PRIVATE KEY-----) - Turnstile Keys (
0x...)
See references/common_secrets.md for complete list and patterns.
Handling Detected Secrets
When secrets are found:
Step 1: Review Findings
Examine each finding to verify it's a real credential (not a placeholder or example).
Step 2: Replace with Environment Variables
Before:
const SUPABASE_URL = "https://your-project-ref.supabase.co";
const API_KEY = "<hardcoded-anon-key-DO-NOT-COMMIT>";
After:
const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || "https://your-project-ref.supabase.co";
const API_KEY = import.meta.env.VITE_API_KEY || "your-api-key-here";
// Validation
if (!import.meta.env.VITE_SUPABASE_URL) {
console.error("⚠️ Missing VITE_SUPABASE_URL environment variable");
}
Step 3: Create .env.example
# Example environment variables
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_API_KEY=your-api-key-here
# Instructions:
# 1. Copy this file to .env
# 2. Replace placeholders with real values
# 3. Never commit .env to version control
Step 4: Verify Cleanup
Run scanner again to confirm secrets removed:
python3 scripts/scan_secrets.py ./my-project
Step 5: Safe Pack
Once clean, package safely:
python3 scripts/safe_pack.py ./my-project
Post-Exposure Actions
If credentials were already exposed (e.g., committed to git, shared publicly):
- Rotate credentials immediately - Generate new keys/tokens
- Revoke old credentials - Disable compromised credentials
- Audit usage - Check logs for unauthorized access
- Monitor - Set up alerts for unusual activity
- Update deployment - Deploy code with new credentials
- Document incident - Record what was exposed and actions taken
Common False Positives
The scanner skips common false positives:
Placeholders:
your-api-key,example-key,placeholder-value<YOUR_API_KEY>,${API_KEY},TODO: add key
Test/Example files:
- Files matching
.*test.*,.*example.*,.*sample.*
Comments:
- Lines starting with
//,#,/*,*
Environment variable references (correct usage):
process.env.API_KEYimport.meta.env.VITE_API_KEYDeno.env.get('API_KEY')
Use --exclude to skip additional patterns if needed.
Integration with Repomix
This skill works with standard repomix:
Default usage (no config):
python3 scripts/safe_pack.py ./project
With repomix config:
python3 scripts/safe_pack.py \
./project \
--config repomix.config.json
Custom output location:
python3 scripts/safe_pack.py \
./project \
--output ~/Downloads/package-clean.xml
The skill runs repomix internally after security validation, passing through config and output options.
Example Workflows
Workflow 1: Package a Clean Project
# Scan and pack in one command
python3 scripts/safe_pack.py \
~/workspace/my-project \
--output ~/Downloads/my-project-package.xml
Workflow 2: Clean and Package a Project with Secrets
# Step 1: Scan to discover secrets
python3 scripts/scan_secrets.py ~/workspace/my-project
# Step 2: Review findings and replace credentials with env vars
# (Edit files manually or with automation)
# Step 3: Verify cleanup
python3 scripts/scan_secrets.py ~/workspace/my-project
# Step 4: Package safely
python3 scripts/safe_pack.py \
~/workspace/my-project \
--output ~/Downloads/my-project-clean.xml
Workflow 3: Audit Before Commit
# Pre-commit hook: scan for secrets
python3 scripts/scan_secrets.py . --json
# Exit code 1 if secrets found (blocks commit)
# Exit code 0 if clean (allows commit)
Resources
References:
references/common_secrets.md- Complete credential pattern catalog
Scripts:
scripts/scan_secrets.py- Standalone security scannerscripts/safe_pack.py- Complete scan → pack workflow
Related Skills:
repomix-unmixer- Extracts files from repomix packagesskill-creator- Creates new Claude Code skills
Security Note
This skill detects common patterns but may not catch all credential types. Always:
- Review findings manually
- Rotate exposed credentials
- Use .env.example templates
- Validate environment variables
- Monitor for unauthorized access
Not a replacement for: Secret scanning in CI/CD, git history scanning, or comprehensive security audits.
FAQ
What does the repomix-safe-mixer skill do?
Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.
How do I install repomix-safe-mixer?
Run npx skills add https://github.com/daymade/claude-code-skills --skill repomix-safe-mixer in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/repomix-safe-mixer/ (personal) or .claude/skills/repomix-safe-mixer/ (project).
Which AI agents can use repomix-safe-mixer?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is repomix-safe-mixer safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains repomix-safe-mixer?
It is published by daymade in daymade/claude-code-skills. It has 914 recorded installs.
More from daymade/claude-code-skills
twitter-reader
daymade/claude-code-skills
Fetches Twitter/X post and Article content — text, author, engagement metrics and embedded media — downloading images locally and generating complete Markdown with image references. Use when retrieving a tweet's text or an X Article with images, or pulling post metadata for a Markdown/PKM record. Preferred over Jina alone for X Articles with images.
i18n-expert
daymade/claude-code-skills
This skill should be used when setting up, auditing, or enforcing internationalization/localization in UI codebases (React/TS, i18next or similar, JSON locales), including installing/configuring the i18n framework, replacing hard-coded strings, ensuring en-US/zh-CN coverage, mapping error codes to localized messages, and validating key parity, pluralization, and formatting.
prompt-optimizer
daymade/claude-code-skills
Transforms vague prompts or feature requests into precise, testable specifications using EARS (Easy Approach to Requirements Syntax) grounded in relevant domain theories (GTD, BJ Fogg, Gestalt). Use when requirements lack triggers or measurable outcomes, or the user asks to "optimize my prompt" / "improve this requirement" / "make this more specific".
ppt-creator
daymade/claude-code-skills
Deprecated presentation entry retained as a compatibility notice. Use to check the retirement status of ppt-creator or identify a legacy installation. This package does not generate PPTX files.
qa-expert
daymade/claude-code-skills
Sets up QA testing processes: test strategies, Google Testing Standards test cases, P0-P4 bug tracking, quality metrics, progress reports, autonomous execution via master prompts, and OWASP security testing, with third-party QA handoff docs. Use when establishing QA infrastructure, writing test cases, executing test plans, or tracking bugs. Not for auditing an already-rendered UI (use frontend-visual-qa).
macos-cleaner
daymade/claude-code-skills
Diagnoses and safely reclaims macOS disk space: caches, logs, app remnants, large/duplicate files, Docker/OrbStack, Chromium code-sign clones, developer caches. Use when a Mac is low on storage, shows “Caching needs more space”, or before deleting anything to avoid data loss. Not for Windows/Linux or permission issues (use macos-permissions).
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.