repomix-safe-mixer：自动检测并移除硬编码凭证，安全打包代码库

repomix-safe-mixer by daymade/claude-code-skills

153 周安装量

778 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/daymade/claude-code-skills --skill repomix-safe-mixer

开发自动化安全

🇨🇳中文介绍

Repomix Safe Mixer

概述

通过自动检测并移除硬编码凭证，安全地打包代码库。

此技能可防止在使用 repomix 打包代码时意外泄露凭证。它会扫描硬编码的密钥（API 密钥、数据库凭证、令牌），报告发现的问题，并确保安全打包。

使用时机：当使用 repomix 打包代码进行分发、创建可共享的参考包，或对代码中的硬编码凭证存在安全顾虑时。

核心工作流程

标准安全打包

使用此技能 scripts/ 目录下的 safe_pack.py 来完成完整的工作流程：扫描 → 报告 → 打包。

python3 scripts/safe_pack.py <directory>

功能：

扫描目录中的硬编码凭证
报告发现的问题，包含文件/行号详情
如果发现密钥则阻止打包
仅在扫描通过后才使用 repomix 打包

示例：

python3 scripts/safe_pack.py ./my-project

如果扫描通过时的输出：

🔍 Scanning ./my-project for hardcoded secrets...
✅ No secrets detected!
📦 Packing ./my-project with repomix...
✅ Packaging complete!
   Package is safe to distribute.

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

检测到的密钥类型

扫描器检测常见的凭证模式，包括：

云服务提供商：

AWS 访问密钥 (AKIA...)
Cloudflare R2 账户 ID 和访问密钥
Supabase 项目 URL 和匿名密钥

Stripe 密钥 (sk_live_..., pk_live_...)
OpenAI API 密钥 (sk-...)
Google Gemini API 密钥 (AIza...)
通用 API 密钥

JWT 令牌 (eyJ...)
OAuth 客户端密钥
私钥 (-----BEGIN PRIVATE KEY-----)
Turnstile 密钥 (0x...)

完整列表和模式请参阅 references/common_secrets.md。

处理检测到的密钥

当发现密钥时：

步骤 1：审查发现项

检查每个发现项，以确认它是真实的凭证（而非占位符或示例）。

步骤 2：替换为环境变量

const SUPABASE_URL = "https://ghyttjckzmzdxumxcixe.supabase.co";
const API_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";

const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || "https://your-project-ref.supabase.co";
const API_KEY = import.meta.env.VITE_API_KEY || "your-api-key-here";

// Validation
if (!import.meta.env.VITE_SUPABASE_URL) {
  console.error("⚠️ Missing VITE_SUPABASE_URL environment variable");
}

步骤 3：创建 .env.example

# Example environment variables
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_API_KEY=your-api-key-here

# Instructions:
# 1. Copy this file to .env
# 2. Replace placeholders with real values
# 3. Never commit .env to version control

步骤 4：验证清理

再次运行扫描器以确认密钥已移除：

python3 scripts/scan_secrets.py ./my-project

步骤 5：安全打包

清理完成后，安全打包：

python3 scripts/safe_pack.py ./my-project

凭证泄露后的应对措施

如果凭证已经泄露（例如，提交到 git、公开分享）：

立即轮换凭证 - 生成新的密钥/令牌
撤销旧凭证 - 停用已泄露的凭证
审计使用情况 - 检查日志中是否有未经授权的访问
监控 - 为异常活动设置警报
更新部署 - 使用新凭证部署代码
记录事件 - 记录泄露的内容和采取的措施

扫描器会跳过常见的误报：

your-api-key, example-key, placeholder-value
<YOUR_API_KEY>, ${API_KEY}, TODO: add key

测试/示例文件：

匹配 .*test.*, .*example.*, .*sample.* 的文件

以 //, #, /*, * 开头的行

环境变量引用（正确用法）：

process.env.API_KEY
import.meta.env.VITE_API_KEY
Deno.env.get('API_KEY')

如果需要，可以使用 --exclude 来跳过额外的模式。

此技能可与标准 repomix 配合使用：

默认用法（无配置）：

python3 scripts/safe_pack.py ./project

使用 repomix 配置：

python3 scripts/safe_pack.py \
  ./project \
  --config repomix.config.json

自定义输出位置：

python3 scripts/safe_pack.py \
  ./project \
  --output ~/Downloads/package-clean.xml

该技能在安全验证后内部运行 repomix，并传递配置和输出选项。

工作流程 1：打包一个干净的项目

# 在一个命令中完成扫描和打包
python3 scripts/safe_pack.py \
  ~/workspace/my-project \
  --output ~/Downloads/my-project-package.xml

工作流程 2：清理并打包一个包含密钥的项目

# 步骤 1：扫描以发现密钥
python3 scripts/scan_secrets.py ~/workspace/my-project

# 步骤 2：审查发现项，并将凭证替换为环境变量
# （手动或通过自动化编辑文件）

# 步骤 3：验证清理
python3 scripts/scan_secrets.py ~/workspace/my-project

# 步骤 4：安全打包
python3 scripts/safe_pack.py \
  ~/workspace/my-project \
  --output ~/Downloads/my-project-clean.xml

工作流程 3：提交前审计

# 提交前钩子：扫描密钥
python3 scripts/scan_secrets.py . --json

# 如果发现密钥则退出码为 1（阻止提交）
# 如果干净则退出码为 0（允许提交）

references/common_secrets.md - 完整的凭证模式目录

scripts/scan_secrets.py - 独立安全扫描器
scripts/safe_pack.py - 完整的扫描 → 打包工作流程

repomix-unmixer - 从 repomix 包中提取文件
skill-creator - 创建新的 Claude Code 技能

此技能检测常见模式，但可能无法捕获所有凭证类型。请务必：

手动审查发现项
轮换已泄露的凭证
使用 .env.example 模板
验证环境变量
监控未经授权的访问

不能替代：CI/CD 中的密钥扫描、git 历史记录扫描或全面的安全审计。

🇺🇸English

Repomix Safe Mixer

Overview

Safely package codebases with repomix by automatically detecting and removing hardcoded credentials.

This skill prevents accidental credential exposure when packaging code with repomix. It scans for hardcoded secrets (API keys, database credentials, tokens), reports findings, and ensures safe packaging.

When to use : When packaging code with repomix for distribution, creating shareable reference packages, or whenever security concerns exist about hardcoded credentials in code.

Core Workflow

Standard Safe Packaging

Use safe_pack.py from this skill's scripts/ directory for the complete workflow: scan → report → pack.

python3 scripts/safe_pack.py <directory>

What it does :

Scans directory for hardcoded credentials
Reports findings with file/line details
Blocks packaging if secrets found
Packs with repomix only if scan is clean

Example :

python3 scripts/safe_pack.py ./my-project

Output if clean :

🔍 Scanning ./my-project for hardcoded secrets...
✅ No secrets detected!
📦 Packing ./my-project with repomix...
✅ Packaging complete!
   Package is safe to distribute.

Output if secrets found :

🔍 Scanning ./my-project for hardcoded secrets...
⚠️  Security Scan Found 3 Potential Secrets:

🔴 supabase_url: 1 instance(s)
   - src/client.ts:5
     Match: https://ghyttjckzmzdxumxcixe.supabase.co

❌ Cannot pack: Secrets detected!

Options

Custom output file :

python3 scripts/safe_pack.py \
  ./my-project \
  --output package.xml

With repomix config :

python3 scripts/safe_pack.py \
  ./my-project \
  --config repomix.config.json

Exclude patterns from scanning :

python3 scripts/safe_pack.py \
  ./my-project \
  --exclude '.*test.*' '.*\.example'

Force pack (dangerous, skip scan) :

python3 scripts/safe_pack.py \
  ./my-project \
  --force  # ⚠️ NOT RECOMMENDED

Standalone Secret Scanning

Use scan_secrets.py from this skill's scripts/ directory for scanning only (without packing).

python3 scripts/scan_secrets.py <directory>

Use cases :

Verify cleanup after removing credentials
Pre-commit security checks
Audit existing codebases

Example :

python3 scripts/scan_secrets.py ./my-project

JSON output for programmatic use :

python3 scripts/scan_secrets.py \
  ./my-project \
  --json

Exclude patterns :

python3 scripts/scan_secrets.py \
  ./my-project \
  --exclude '.*test.*' '.*example.*' '.*SECURITY_AUDIT\.md'

Detected Secret Types

The scanner detects common credential patterns including:

Cloud Providers :

AWS Access Keys (AKIA...)
Cloudflare R2 Account IDs and Access Keys
Supabase Project URLs and Anon Keys

API Keys :

Stripe Keys (sk_live_..., pk_live_...)
OpenAI API Keys (sk-...)
Google Gemini API Keys (AIza...)
Generic API Keys

Authentication :

JWT Tokens (eyJ...)
OAuth Client Secrets
Private Keys (-----BEGIN PRIVATE KEY-----)
Turnstile Keys (0x...)

See references/common_secrets.md for complete list and patterns.

Handling Detected Secrets

When secrets are found:

Step 1: Review Findings

Examine each finding to verify it's a real credential (not a placeholder or example).

Step 2: Replace with Environment Variables

Before :

const SUPABASE_URL = "https://ghyttjckzmzdxumxcixe.supabase.co";
const API_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";

After :

const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || "https://your-project-ref.supabase.co";
const API_KEY = import.meta.env.VITE_API_KEY || "your-api-key-here";

// Validation
if (!import.meta.env.VITE_SUPABASE_URL) {
  console.error("⚠️ Missing VITE_SUPABASE_URL environment variable");
}

Step 3: Create .env.example

# Example environment variables
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_API_KEY=your-api-key-here

# Instructions:
# 1. Copy this file to .env
# 2. Replace placeholders with real values
# 3. Never commit .env to version control

Step 4: Verify Cleanup

Run scanner again to confirm secrets removed:

python3 scripts/scan_secrets.py ./my-project

Step 5: Safe Pack

Once clean, package safely:

python3 scripts/safe_pack.py ./my-project

Post-Exposure Actions

If credentials were already exposed (e.g., committed to git, shared publicly):

Rotate credentials immediately - Generate new keys/tokens
Revoke old credentials - Disable compromised credentials
Audit usage - Check logs for unauthorized access
Monitor - Set up alerts for unusual activity
Update deployment - Deploy code with new credentials
Document incident - Record what was exposed and actions taken

Common False Positives

The scanner skips common false positives:

Placeholders :

your-api-key, example-key, placeholder-value
<YOUR_API_KEY>, ${API_KEY}, TODO: add key

Test/Example files :

Files matching .*test.*, .*example.*, .*sample.*

Comments :

Lines starting with //, #, /*, *

Environment variable references (correct usage):

process.env.API_KEY
import.meta.env.VITE_API_KEY
Deno.env.get('API_KEY')

Use --exclude to skip additional patterns if needed.

Integration with Repomix

This skill works with standard repomix:

Default usage (no config):

python3 scripts/safe_pack.py ./project

With repomix config :

python3 scripts/safe_pack.py \
  ./project \
  --config repomix.config.json

Custom output location :

python3 scripts/safe_pack.py \
  ./project \
  --output ~/Downloads/package-clean.xml

The skill runs repomix internally after security validation, passing through config and output options.

Example Workflows

Workflow 1: Package a Clean Project

# Scan and pack in one command
python3 scripts/safe_pack.py \
  ~/workspace/my-project \
  --output ~/Downloads/my-project-package.xml

Workflow 2: Clean and Package a Project with Secrets

# Step 1: Scan to discover secrets
python3 scripts/scan_secrets.py ~/workspace/my-project

# Step 2: Review findings and replace credentials with env vars
# (Edit files manually or with automation)

# Step 3: Verify cleanup
python3 scripts/scan_secrets.py ~/workspace/my-project

# Step 4: Package safely
python3 scripts/safe_pack.py \
  ~/workspace/my-project \
  --output ~/Downloads/my-project-clean.xml

Workflow 3: Audit Before Commit

# Pre-commit hook: scan for secrets
python3 scripts/scan_secrets.py . --json

# Exit code 1 if secrets found (blocks commit)
# Exit code 0 if clean (allows commit)

Resources

References :

references/common_secrets.md - Complete credential pattern catalog

Scripts :

scripts/scan_secrets.py - Standalone security scanner
scripts/safe_pack.py - Complete scan → pack workflow

Related Skills :

repomix-unmixer - Extracts files from repomix packages
skill-creator - Creates new Claude Code skills

Security Note

This skill detects common patterns but may not catch all credential types. Always:

Review findings manually
Rotate exposed credentials
Use .env.example templates
Validate environment variables
Monitor for unauthorized access

Not a replacement for : Secret scanning in CI/CD, git history scanning, or comprehensive security audits.

Weekly Installs

Repository

daymade/claude-…e-skills

GitHub Stars

628

First Seen

Jan 21, 2026

Security Audits

Gen Agent Trust HubFail SocketPass SnykFail

Installed on

claude-code61

opencode55

codex52

gemini-cli51

cursor48

github-copilot44

agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试

157,400 周安装

repomix-safe-mixer：自动检测并移除硬编码凭证，安全打包代码库

🇨🇳中文介绍

Repomix Safe Mixer

概述

核心工作流程

标准安全打包

相关 Skills

选项

独立密钥扫描

检测到的密钥类型

处理检测到的密钥

步骤 1：审查发现项

步骤 2：替换为环境变量

步骤 3：创建 .env.example

步骤 4：验证清理

步骤 5：安全打包

凭证泄露后的应对措施

常见误报

与 Repomix 集成

示例工作流程

工作流程 1：打包一个干净的项目

工作流程 2：清理并打包一个包含密钥的项目

工作流程 3：提交前审计

资源

安全说明

🇺🇸English

Repomix Safe Mixer

Overview

Core Workflow

Standard Safe Packaging

Options

Standalone Secret Scanning

Detected Secret Types

Handling Detected Secrets

Step 1: Review Findings

Step 2: Replace with Environment Variables

Step 3: Create .env.example

Step 4: Verify Cleanup

Step 5: Safe Pack

Post-Exposure Actions

Common False Positives

Integration with Repomix

Example Workflows

Workflow 1: Package a Clean Project

Workflow 2: Clean and Package a Project with Secrets

Workflow 3: Audit Before Commit

Resources

Security Note

最新 Skills