Agent skill · security · daymade
repomix-safe-mixer
Safely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.
Why this skill is useful
Adds an executable script for scanning and safely packaging codebases by removing hardcoded credentials, which is not commonly found in public documentation.
What it needs
Requires python3 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 1,320 stars on the source repository.
What this skill does
Repomix Safe Mixer Overview Safely package codebases with repomix by automatically detecting and removing hardcoded credentials. This skill prevents accidental credential exposure when packaging code with repomix. It scans for hardcoded secrets (API keys, database credentials, tokens), reports findings, and ensures safe packaging. When to use: When packaging code with repomix for distribution, creating shareable reference packages, or whenever security concerns exist about hardcoded credentials in code. Core Workflow Standard Safe Packaging Use safepack.py from this skill's scripts/ directory for the complete workflow: scan → report → pack. What it does: 1. Scans directory for hardcoded credentials 2. Reports findings with file/line details 3. Blocks packaging if secrets found 4. Packs with repomix only if scan is clean Example: Output if clean: Output if secrets found: Options Custom output file: With repomix config: Exclude patterns from scanning: Force pack (dangerous, skip scan): Standalone Secret Scanning Use scansecrets.py from this skill's scripts/ directory for scanning only (without packing). Use cases: Verify cleanup after removing credentials Pre-commit security checks Audit existing codebases Example: JSON output for programmatic use: Exclude patterns: Detected Secret Types The scanner detects common credential patterns including: Cloud Providers: AWS Access Keys (AKIA...) Cloudflare R2 Account IDs and Access Keys Supabase Project URLs and Anon Keys API Keys: Stripe Keys (sklive..., pklive...) OpenAI API Keys (sk-...) Google Gemini API Keys (AIza...) Generic API Keys Authentication: JWT Tokens (eyJ...) OAuth Client Secrets Private Keys (-----BEGIN PRIVATE KEY-----) Turnstile Keys (0x...) See references/commonsecrets.md for complete list and patterns. Handling Detected Secrets When secrets are found: Step 1: Review Findings Examine each finding to verify it's a real credential (not a placeholder or example). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills daymade/repomix-safe-mixer