Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.

Repomix Safe Mixer Overview Safely package codebases with repomix by automatically detecting and removing hardcoded credentials. This skill prevents accidental credential exposure when packaging code with repomix. It scans for hardcoded secrets (API keys, database credentials, tokens), reports findings, and ensures safe packaging. When to use : When packaging code with repomix for distribution, creating shareable reference packages, or whenever security concerns exist about hardcoded credentials in code. Core Workflow Standard Safe Packaging Use safe pack.py from this skill's scripts/ directory for the complete workflow: scan → report → pack. What it does : 1. Scans directory for hardcoded credentials 2. Reports findings with file/line details 3. Blocks packaging if secrets found 4. Packs with repomix only if scan is clean Example : Output if clean : Output if secrets found : Options Custom output file : With repomix config : Exclude patterns from scanning : Force pack (dangerous, skip scan) : Standalone Secret Scanning Use scan secrets.py from this skill's scripts/ directory for scanning only (without packing). Use cases : Verify cleanup after removing credentials Pre commit security checks Audit existing codebases Example : JSON output for programmatic use : Exclude patterns : Detected Secret Types The scanner detects common credential patterns including: Cloud Providers : AWS Access Keys ( AKIA... ) Cloudflare R2 Account IDs and Access Keys Supabase Project URLs and Anon Keys API Keys : Stripe Keys ( sk live ... , pk live ... ) OpenAI API Keys ( sk ... ) Google Gemini API Keys ( AIza... ) Generic API Keys Authentication : JWT Tokens ( eyJ... ) OAuth Client Secrets Private Keys ( BEGIN PRIVATE KEY ) Turnstile Keys ( 0x... ) See references/common secrets.md for complete list and patterns. Handling Detected Secrets When secrets are found: Step 1: Review Findings Examine each finding to verify it's a real credential (not a placeholder or example). Step 2: Replace with Environment Variables Before : After : Step 3: Create .env.example Step 4: Verify Cleanup Run scanner again to confirm secrets removed: Step 5: Safe Pack Once clean, package safely: Post Exposure Actions If credentials were already exposed (e.g., committed to git, shared publicly): 1. Rotate credentials immediately Generate new keys/tokens 2. Revoke old credentials Disable compromised credentials 3. Audit usage Check logs for unauthorized access 4. Monitor Set up alerts for unusual activity 5. Update deployment Deploy code with new credentials 6. Document incident Record what was exposed and actions taken Common False Positives The scanner skips common false positives: Placeholders : your api key , example key , placeholder value <YOUR API KEY , ${API KEY} , TODO: add key Test/Example files : Files matching . test. , . example. , . sample. Comments : Lines starting with // , , / , Environment variable references (correct usage): process.env.API KEY import.meta.env.VITE API KEY Deno.env.get('API KEY') Use exclude to skip additional patterns if needed. Integration with Repomix This skill works with standard repomix: Default usage (no config): With repomix config : Custom output location : The skill runs repomix internally after security validation, passing through config and output options. Example Workflows Workflow 1: Package a Clean Project Workflow 2: Clean and Package a Project with Secrets Workflow 3: Audit Before Commit Resources References : references/common secrets.md Complete credential pattern catalog Scripts : scripts/scan secrets.py Standalone security scanner scripts/safe pack.py Complete scan → pack workflow Related Skills : repomix unmixer Extracts files from repomix packages skill creator Creates new Claude Code skills Security Note This skill detects common patterns but may not catch all credential types. Always: Review findings manually Rotate exposed credentials Use .env.example templates Validate environment variables Monitor for unauthorized access Not a replacement for : Secret scanning in CI/CD, git history scanning, or comprehensive security audits.

repomix-safe-mixer