New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Repomix Safe Mixer

by daymade in daymade/claude-code-skills

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing.

MITAuto-check: notesAgent Workflows

Install Repomix Safe Mixer

skills CLI
$ npx skills add daymade/claude-code-skills --skill repomix-safe-mixer -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install daymade/claude-code-skills repomix-safe-mixer --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/daymade/claude-code-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/repomix-safe-mixer .claude/skills/repomix-safe-mixer && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
repomix-safe-mixer
GitHub stars
1.4k
Token cost
~2k tokens
SKILL.md length
539 words
Files
4 (incl. scripts, references)
Skills in repo
103
Repo updated
First seen
Licence
MIT

At a glance

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing.

  • Works in 5 steps: Review Findings → Replace with Environment Variables → Create .env.example → …
  • Packaging code for distribution
  • SKILL.md covers Overview, Core Workflow, Standalone Secret Scanning and Detected Secret Types, plus 7 more sections
  • Runs Python scripts from its folder; calls python3; needs API_KEY and VITE_API_KEY

What it does

Repomix Safe Mixer is an agent skill from daymade/claude-code-skills. Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.

Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/common_secrets.md`, `scripts/safe_pack.py` and `scripts/scan_secrets.py`).

It sits in Agent Workflows, covering Codebase knowledge for agents. The repository describes itself as: Professional Claude Code skills marketplace featuring production-ready skills for enhanced development workflows. The licence is MIT.

When your agent uses it

  • Packaging code for distribution
  • Creating reference packages
  • The user mentions security concerns about sharing code with repomix

Example prompts

  • “/repomix-safe-mixer”

Requirements

  • Python 3
  • A credential in API_KEY
  • A credential in VITE_API_KEY

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Review Findings
  2. Replace with Environment Variables
  3. Create .env.example
  4. Verify Cleanup
  5. Safe Pack

What it can do on your machine

Read from SKILL.md and the folder at commit 872127b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • API_KEY
    • VITE_API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Repomix Safe Mixer loads about 2k tokens when it runs, and up to ~3.6k if it reads all its reference files. Until then it costs about 71 tokens; SKILL.md has 539 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~71
When it runs · the whole SKILL.md, loaded when a task matches
~2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~3.6k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:178
    # 1. Copy this file to .env
  • NoteMentions a .env fileSKILL.md:180
    # 3. Never commit .env to version control

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from daymade/claude-code-skills at commit 872127b, republished under its MIT licence (© daymade). 539 words, ~1,957 tokens.

Download SKILL.mdSave it as .claude/skills/repomix-safe-mixer/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
repomix-safe-mixer
description
Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.

Repomix Safe Mixer

Overview

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials.

This skill prevents accidental credential exposure when packaging code with repomix. It scans for hardcoded secrets (API keys, database credentials, tokens), reports findings, and ensures safe packaging.

When to use: When packaging code with repomix for distribution, creating shareable reference packages, or whenever security concerns exist about hardcoded credentials in code.

Core Workflow

Standard Safe Packaging

Use safe_pack.py from this skill's scripts/ directory for the complete workflow: scan → report → pack.

bash
python3 scripts/safe_pack.py <directory>

What it does:

  1. Scans directory for hardcoded credentials
  2. Reports findings with file/line details
  3. Blocks packaging if secrets found
  4. Packs with repomix only if scan is clean

Example:

bash
python3 scripts/safe_pack.py ./my-project

Output if clean:

🔍 Scanning ./my-project for hardcoded secrets...
✅ No secrets detected!
📦 Packing ./my-project with repomix...
✅ Packaging complete!
   Package is safe to distribute.

Output if secrets found:

🔍 Scanning ./my-project for hardcoded secrets...
⚠️  Security Scan Found 3 Potential Secrets:

🔴 supabase_url: 1 instance(s)
   - src/client.ts:5
     Match: https://your-project-ref.supabase.co

❌ Cannot pack: Secrets detected!
Options

Custom output file:

bash
python3 scripts/safe_pack.py \
  ./my-project \
  --output package.xml

With repomix config:

bash
python3 scripts/safe_pack.py \
  ./my-project \
  --config repomix.config.json

Exclude patterns from scanning:

bash
python3 scripts/safe_pack.py \
  ./my-project \
  --exclude '.*test.*' '.*\.example'

Force pack (dangerous, skip scan):

bash
python3 scripts/safe_pack.py \
  ./my-project \
  --force  # ⚠️ NOT RECOMMENDED

Standalone Secret Scanning

Use scan_secrets.py from this skill's scripts/ directory for scanning only (without packing).

bash
python3 scripts/scan_secrets.py <directory>

Use cases:

  • Verify cleanup after removing credentials
  • Pre-commit security checks
  • Audit existing codebases

Example:

bash
python3 scripts/scan_secrets.py ./my-project

JSON output for programmatic use:

bash
python3 scripts/scan_secrets.py \
  ./my-project \
  --json

Exclude patterns:

bash
python3 scripts/scan_secrets.py \
  ./my-project \
  --exclude '.*test.*' '.*example.*' '.*SECURITY_AUDIT\.md'

Detected Secret Types

The scanner detects common credential patterns including:

Cloud Providers:

  • AWS Access Keys (AKIA...)
  • Cloudflare R2 Account IDs and Access Keys
  • Supabase Project URLs and Anon Keys

API Keys:

  • Stripe Keys (sk_live_..., pk_live_...)
  • OpenAI API Keys (sk-...)
  • Google Gemini API Keys (AIza...)
  • Generic API Keys

Authentication:

  • JWT Tokens (eyJ...)
  • OAuth Client Secrets
  • Private Keys (-----BEGIN PRIVATE KEY-----)
  • Turnstile Keys (0x...)

See references/common_secrets.md for complete list and patterns.

Handling Detected Secrets

When secrets are found:

Step 1: Review Findings

Examine each finding to verify it's a real credential (not a placeholder or example).

Step 2: Replace with Environment Variables

Before:

javascript
const SUPABASE_URL = "https://your-project-ref.supabase.co";
const API_KEY = "<hardcoded-anon-key-DO-NOT-COMMIT>";

After:

javascript
const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || "https://your-project-ref.supabase.co";
const API_KEY = import.meta.env.VITE_API_KEY || "your-api-key-here";

// Validation
if (!import.meta.env.VITE_SUPABASE_URL) {
  console.error("⚠️ Missing VITE_SUPABASE_URL environment variable");
}
Step 3: Create .env.example
bash
# Example environment variables
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_API_KEY=your-api-key-here

# Instructions:
# 1. Copy this file to .env
# 2. Replace placeholders with real values
# 3. Never commit .env to version control
Step 4: Verify Cleanup

Run scanner again to confirm secrets removed:

bash
python3 scripts/scan_secrets.py ./my-project
Step 5: Safe Pack

Once clean, package safely:

bash
python3 scripts/safe_pack.py ./my-project
Show full SKILL.md (238 more words)Show less

Post-Exposure Actions

If credentials were already exposed (e.g., committed to git, shared publicly):

  1. Rotate credentials immediately - Generate new keys/tokens
  2. Revoke old credentials - Disable compromised credentials
  3. Audit usage - Check logs for unauthorized access
  4. Monitor - Set up alerts for unusual activity
  5. Update deployment - Deploy code with new credentials
  6. Document incident - Record what was exposed and actions taken

Common False Positives

The scanner skips common false positives:

Placeholders:

  • your-api-key, example-key, placeholder-value
  • <YOUR_API_KEY>, ${API_KEY}, TODO: add key

Test/Example files:

  • Files matching .*test.*, .*example.*, .*sample.*

Comments:

  • Lines starting with //, #, /*, *

Environment variable references (correct usage):

  • process.env.API_KEY
  • import.meta.env.VITE_API_KEY
  • Deno.env.get('API_KEY')

Use --exclude to skip additional patterns if needed.

Integration with Repomix

This skill works with standard repomix:

Default usage (no config):

bash
python3 scripts/safe_pack.py ./project

With repomix config:

bash
python3 scripts/safe_pack.py \
  ./project \
  --config repomix.config.json

Custom output location:

bash
python3 scripts/safe_pack.py \
  ./project \
  --output ~/Downloads/package-clean.xml

The skill runs repomix internally after security validation, passing through config and output options.

Example Workflows

Workflow 1: Package a Clean Project
bash
# Scan and pack in one command
python3 scripts/safe_pack.py \
  ~/workspace/my-project \
  --output ~/Downloads/my-project-package.xml
Workflow 2: Clean and Package a Project with Secrets
bash
# Step 1: Scan to discover secrets
python3 scripts/scan_secrets.py ~/workspace/my-project

# Step 2: Review findings and replace credentials with env vars
# (Edit files manually or with automation)

# Step 3: Verify cleanup
python3 scripts/scan_secrets.py ~/workspace/my-project

# Step 4: Package safely
python3 scripts/safe_pack.py \
  ~/workspace/my-project \
  --output ~/Downloads/my-project-clean.xml
Workflow 3: Audit Before Commit
bash
# Pre-commit hook: scan for secrets
python3 scripts/scan_secrets.py . --json

# Exit code 1 if secrets found (blocks commit)
# Exit code 0 if clean (allows commit)

Resources

References:

  • references/common_secrets.md - Complete credential pattern catalog

Scripts:

  • scripts/scan_secrets.py - Standalone security scanner
  • scripts/safe_pack.py - Complete scan → pack workflow

Related Skills:

  • repomix-unmixer - Extracts files from repomix packages
  • skill-creator - Creates new Claude Code skills

Security Note

This skill detects common patterns but may not catch all credential types. Always:

  • Review findings manually
  • Rotate exposed credentials
  • Use .env.example templates
  • Validate environment variables
  • Monitor for unauthorized access

Not a replacement for: Secret scanning in CI/CD, git history scanning, or comprehensive security audits.

© daymade, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in repomix-safe-mixer of daymade/claude-code-skills.

  • SKILL.md
  • references/common_secrets.md
  • scripts/safe_pack.py
  • scripts/scan_secrets.py

Open the folder on GitHubat commit 872127b

Compare with similar skills

Repomix Safe Mixer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Repomix Safe Mixer compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Repomix Safe Mixer this skilldaymade/claude-code-skills1.4k—~2kAutomated safety check: NotesMIT
ccc Semantic Code Searchcocoindex-io/cocoindex-code2.8k—~938Automated safety check: PassApache-2.0
Context Engineeringabashev/vfs-s31069 repos~2.6kAutomated safety check: NotesApache-2.0
Repomix Codebase Packeryamadashy/repomix29k—~1.3kAutomated safety check: NotesMIT
Codebase Handbook BuilderRuhan-Wang/Harness_Handbook333—~2.2kAutomated safety check: PassApache-2.0
CodemapJordanCoin/codemap704—~1.8kAutomated safety check: PassMIT

Similar skills

  • ccc Semantic Code Search

    cocoindex-io/cocoindex-code

    Semantic code search and index management with the ccc CLI: the agent initializes, indexes and queries the project by concept, filtering by language or path.

    2.8k GitHub stars~938 tokensUpdated 3 days ago
    Agent WorkflowsAuto-check passed

  • Context Engineering

    abashev/vfs-s3

    Optimizes agent context setup. An agent skill from abashev/vfs-s3.

    106 GitHub starsUsed in 9 repos~2.6k tokens
    Agent WorkflowsAuto-check: notes

  • Repomix Codebase Packer

    yamadashy/repomix

    Packs a local directory or remote GitHub repository into one AI-friendly file with Repomix, then searches it to explore structure, find patterns and count tokens.

    29k GitHub stars~1.3k tokensUpdated 6 days ago
    Agent WorkflowsAuto-check: notes

  • Codebase Handbook Builder

    Ruhan-Wang/Harness_Handbook

    Generates, refreshes, validates and uses a compact handbook that maps where a change touches in a repository, using the active Codex session and no external LLM API.

    333 GitHub stars~2.2k tokensUpdated 1 mo ago
    Agent WorkflowsAuto-check passed

  • Codemap

    JordanCoin/codemap

    Gives an agent a quick map of a codebase's structure, dependencies, changes and handoffs, and tunes per-project config so the output stays code-first.

    704 GitHub stars~1.8k tokensUpdated yesterday
    Agent WorkflowsAuto-check passed

  • Repomix Context Skill

    sopaco/deepwiki-rs

    A skill your agent uses when an agent needs source code from the local repomix index under .terrain/agent/repomix.md (not committed; regenerate via Terrain scan).

    3.1k GitHub stars~671 tokensUpdated 25 days ago
    Agent WorkflowsAuto-check passed

More from daymade/claude-code-skills

All 103 skills in this repo

  • Video Comparer

    daymade/claude-code-skills

    This skill should be used when comparing two videos to analyze compression results or quality differences.

    1.4k GitHub starsUsed in 1 repo~1.4k tokens
    Auto-check: notes

  • CLI Demo Generator

    daymade/claude-code-skills

    Generates professional animated CLI demos as GIFs using VHS terminal recordings.

    1.4k GitHub stars~1.7k tokensUpdated today
    Auto-check passed

  • Doc To Markdown

    daymade/claude-code-skills

    Converts DOCX/PDF/PPTX and saved HTML/HTM to high-quality Markdown with automatic post-processing.

    1.4k GitHub stars~2.5k tokensUpdated today
    Auto-check passed

  • Interaction Design Board

    daymade/claude-code-skills

    Generates several distinct, clickable HTML interaction prototypes for one product surface into a Design Board and collects selection/remix feedback before implementation.

    1.4k GitHub stars~2.7k tokensUpdated today
    Auto-check passed

  • Auto Repo Setup

    daymade/claude-code-skills

    Diagnoses and repairs repository setup and guarded Git workflows for Claude Code or Codex — environment repair, startup sync, hook auditing, collaborator handoff.

    1.4k GitHub stars~2.8k tokensUpdated today
    Auto-check: notes

  • Bigdata Skill

    daymade/claude-code-skills

    Pulls Bigdata.com (RavenPack) financial and news data via the official bigdata-client SDK and /v1/ REST endpoints — structured financials, prices, analyst estimates, entity-sentiment series…

    1.4k GitHub stars~3.7k tokensUpdated today
    Auto-check passed

Categories

Questions about Repomix Safe Mixer

What does Repomix Safe Mixer do?

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Repomix Safe Mixer is an agent skill from daymade/claude-code-skills. Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing.

When should I use Repomix Safe Mixer?

Repomix Safe Mixer fits situations like: packaging code for distribution; creating reference packages; the user mentions security concerns about sharing code with repomix.

How do I install Repomix Safe Mixer in Claude Code?

Run `npx skills add daymade/claude-code-skills --skill repomix-safe-mixer -a claude-code`. Or copy the skill folder (repomix-safe-mixer in daymade/claude-code-skills) into .claude/skills/repomix-safe-mixer in your project. Claude Code loads it when a task matches its description.

How do I install Repomix Safe Mixer in Codex?

Run `npx skills add daymade/claude-code-skills --skill repomix-safe-mixer -a codex`. Or copy the skill folder (repomix-safe-mixer in daymade/claude-code-skills) into .agents/skills/repomix-safe-mixer in your project. Codex loads it when a task matches its description.

Can I use Repomix Safe Mixer in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add daymade/claude-code-skills --skill repomix-safe-mixer -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/repomix-safe-mixer, .gemini/skills/repomix-safe-mixer, .github/skills/repomix-safe-mixer and .opencode/skills/repomix-safe-mixer in your project.

What does Repomix Safe Mixer need to run?

Going by SKILL.md and its folder, Repomix Safe Mixer needs Python for the scripts in its folder, the command-line tools its instructions call (python3) and credentials named API_KEY and VITE_API_KEY. Our summary lists: Python 3; A credential in API_KEY; A credential in VITE_API_KEY.

Does Repomix Safe Mixer access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Repomix Safe Mixer safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Repomix Safe Mixer use?

Repomix Safe Mixer is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Repomix Safe Mixer use?

About 2k tokens (SKILL.md is roughly 7.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.6k tokens, read only when the agent opens those files.

What are the alternatives to Repomix Safe Mixer?

Skills that share tags, products or a category with Repomix Safe Mixer: ccc Semantic Code Search (cocoindex-io/cocoindex-code, 2.8k stars), Context Engineering (abashev/vfs-s3, 106 stars), Repomix Codebase Packer (yamadashy/repomix, 29k stars) and Codebase Handbook Builder (Ruhan-Wang/Harness_Handbook, 333 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Repomix Safe Mixer?

daymade (a GitHub user) maintains it in daymade/claude-code-skills, which has 1,447 GitHub stars. The repository holds 103 skills in this directory. The repository was last updated on October 9, 2026.

Source: daymade/claude-code-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.