repomix-safe-mixer by daymade/claude-code-skills
npx skills add https://github.com/daymade/claude-code-skills --skill repomix-safe-mixer通过自动检测并移除硬编码凭证,安全地打包代码库。
此技能可防止在使用 repomix 打包代码时意外泄露凭证。它会扫描硬编码的密钥(API 密钥、数据库凭证、令牌),报告发现的问题,并确保安全打包。
使用时机:当使用 repomix 打包代码进行分发、创建可共享的参考包,或对代码中的硬编码凭证存在安全顾虑时。
使用此技能 scripts/ 目录下的 safe_pack.py 来完成完整的工作流程:扫描 → 报告 → 打包。
python3 scripts/safe_pack.py <directory>
功能:
示例:
python3 scripts/safe_pack.py ./my-project
如果扫描通过时的输出:
🔍 Scanning ./my-project for hardcoded secrets...
✅ No secrets detected!
📦 Packing ./my-project with repomix...
✅ Packaging complete!
Package is safe to distribute.
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
如果发现密钥时的输出:
🔍 Scanning ./my-project for hardcoded secrets...
⚠️ Security Scan Found 3 Potential Secrets:
🔴 supabase_url: 1 instance(s)
- src/client.ts:5
Match: https://ghyttjckzmzdxumxcixe.supabase.co
❌ Cannot pack: Secrets detected!
自定义输出文件:
python3 scripts/safe_pack.py \
./my-project \
--output package.xml
使用 repomix 配置:
python3 scripts/safe_pack.py \
./my-project \
--config repomix.config.json
从扫描中排除模式:
python3 scripts/safe_pack.py \
./my-project \
--exclude '.*test.*' '.*\.example'
强制打包(危险,跳过扫描):
python3 scripts/safe_pack.py \
./my-project \
--force # ⚠️ NOT RECOMMENDED
使用此技能 scripts/ 目录下的 scan_secrets.py 进行仅扫描(不打包)。
python3 scripts/scan_secrets.py <directory>
使用场景:
示例:
python3 scripts/scan_secrets.py ./my-project
用于编程的 JSON 输出:
python3 scripts/scan_secrets.py \
./my-project \
--json
排除模式:
python3 scripts/scan_secrets.py \
./my-project \
--exclude '.*test.*' '.*example.*' '.*SECURITY_AUDIT\.md'
扫描器检测常见的凭证模式,包括:
云服务提供商:
AKIA...)API 密钥:
sk_live_..., pk_live_...)sk-...)AIza...)身份验证:
eyJ...)-----BEGIN PRIVATE KEY-----)0x...)完整列表和模式请参阅 references/common_secrets.md。
当发现密钥时:
检查每个发现项,以确认它是真实的凭证(而非占位符或示例)。
替换前:
const SUPABASE_URL = "https://ghyttjckzmzdxumxcixe.supabase.co";
const API_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
替换后:
const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || "https://your-project-ref.supabase.co";
const API_KEY = import.meta.env.VITE_API_KEY || "your-api-key-here";
// Validation
if (!import.meta.env.VITE_SUPABASE_URL) {
console.error("⚠️ Missing VITE_SUPABASE_URL environment variable");
}
# Example environment variables
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_API_KEY=your-api-key-here
# Instructions:
# 1. Copy this file to .env
# 2. Replace placeholders with real values
# 3. Never commit .env to version control
再次运行扫描器以确认密钥已移除:
python3 scripts/scan_secrets.py ./my-project
清理完成后,安全打包:
python3 scripts/safe_pack.py ./my-project
如果凭证已经泄露(例如,提交到 git、公开分享):
扫描器会跳过常见的误报:
占位符:
your-api-key, example-key, placeholder-value<YOUR_API_KEY>, ${API_KEY}, TODO: add key测试/示例文件:
.*test.*, .*example.*, .*sample.* 的文件注释:
//, #, /*, * 开头的行环境变量引用(正确用法):
process.env.API_KEYimport.meta.env.VITE_API_KEYDeno.env.get('API_KEY')如果需要,可以使用 --exclude 来跳过额外的模式。
此技能可与标准 repomix 配合使用:
默认用法(无配置):
python3 scripts/safe_pack.py ./project
使用 repomix 配置:
python3 scripts/safe_pack.py \
./project \
--config repomix.config.json
自定义输出位置:
python3 scripts/safe_pack.py \
./project \
--output ~/Downloads/package-clean.xml
该技能在安全验证后内部运行 repomix,并传递配置和输出选项。
# 在一个命令中完成扫描和打包
python3 scripts/safe_pack.py \
~/workspace/my-project \
--output ~/Downloads/my-project-package.xml
# 步骤 1:扫描以发现密钥
python3 scripts/scan_secrets.py ~/workspace/my-project
# 步骤 2:审查发现项,并将凭证替换为环境变量
# (手动或通过自动化编辑文件)
# 步骤 3:验证清理
python3 scripts/scan_secrets.py ~/workspace/my-project
# 步骤 4:安全打包
python3 scripts/safe_pack.py \
~/workspace/my-project \
--output ~/Downloads/my-project-clean.xml
# 提交前钩子:扫描密钥
python3 scripts/scan_secrets.py . --json
# 如果发现密钥则退出码为 1(阻止提交)
# 如果干净则退出码为 0(允许提交)
参考资料:
references/common_secrets.md - 完整的凭证模式目录脚本:
scripts/scan_secrets.py - 独立安全扫描器scripts/safe_pack.py - 完整的扫描 → 打包工作流程相关技能:
repomix-unmixer - 从 repomix 包中提取文件skill-creator - 创建新的 Claude Code 技能此技能检测常见模式,但可能无法捕获所有凭证类型。请务必:
不能替代:CI/CD 中的密钥扫描、git 历史记录扫描或全面的安全审计。
每周安装数
76
代码仓库
GitHub 星标数
628
首次出现
2026年1月21日
安全审计
安装于
claude-code61
opencode55
codex52
gemini-cli51
cursor48
github-copilot44
Safely package codebases with repomix by automatically detecting and removing hardcoded credentials.
This skill prevents accidental credential exposure when packaging code with repomix. It scans for hardcoded secrets (API keys, database credentials, tokens), reports findings, and ensures safe packaging.
When to use : When packaging code with repomix for distribution, creating shareable reference packages, or whenever security concerns exist about hardcoded credentials in code.
Use safe_pack.py from this skill's scripts/ directory for the complete workflow: scan → report → pack.
python3 scripts/safe_pack.py <directory>
What it does :
Example :
python3 scripts/safe_pack.py ./my-project
Output if clean :
🔍 Scanning ./my-project for hardcoded secrets...
✅ No secrets detected!
📦 Packing ./my-project with repomix...
✅ Packaging complete!
Package is safe to distribute.
Output if secrets found :
🔍 Scanning ./my-project for hardcoded secrets...
⚠️ Security Scan Found 3 Potential Secrets:
🔴 supabase_url: 1 instance(s)
- src/client.ts:5
Match: https://ghyttjckzmzdxumxcixe.supabase.co
❌ Cannot pack: Secrets detected!
Custom output file :
python3 scripts/safe_pack.py \
./my-project \
--output package.xml
With repomix config :
python3 scripts/safe_pack.py \
./my-project \
--config repomix.config.json
Exclude patterns from scanning :
python3 scripts/safe_pack.py \
./my-project \
--exclude '.*test.*' '.*\.example'
Force pack (dangerous, skip scan) :
python3 scripts/safe_pack.py \
./my-project \
--force # ⚠️ NOT RECOMMENDED
Use scan_secrets.py from this skill's scripts/ directory for scanning only (without packing).
python3 scripts/scan_secrets.py <directory>
Use cases :
Example :
python3 scripts/scan_secrets.py ./my-project
JSON output for programmatic use :
python3 scripts/scan_secrets.py \
./my-project \
--json
Exclude patterns :
python3 scripts/scan_secrets.py \
./my-project \
--exclude '.*test.*' '.*example.*' '.*SECURITY_AUDIT\.md'
The scanner detects common credential patterns including:
Cloud Providers :
AKIA...)API Keys :
sk_live_..., pk_live_...)sk-...)AIza...)Authentication :
eyJ...)-----BEGIN PRIVATE KEY-----)0x...)See references/common_secrets.md for complete list and patterns.
When secrets are found:
Examine each finding to verify it's a real credential (not a placeholder or example).
Before :
const SUPABASE_URL = "https://ghyttjckzmzdxumxcixe.supabase.co";
const API_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
After :
const SUPABASE_URL = import.meta.env.VITE_SUPABASE_URL || "https://your-project-ref.supabase.co";
const API_KEY = import.meta.env.VITE_API_KEY || "your-api-key-here";
// Validation
if (!import.meta.env.VITE_SUPABASE_URL) {
console.error("⚠️ Missing VITE_SUPABASE_URL environment variable");
}
# Example environment variables
VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_API_KEY=your-api-key-here
# Instructions:
# 1. Copy this file to .env
# 2. Replace placeholders with real values
# 3. Never commit .env to version control
Run scanner again to confirm secrets removed:
python3 scripts/scan_secrets.py ./my-project
Once clean, package safely:
python3 scripts/safe_pack.py ./my-project
If credentials were already exposed (e.g., committed to git, shared publicly):
The scanner skips common false positives:
Placeholders :
your-api-key, example-key, placeholder-value<YOUR_API_KEY>, ${API_KEY}, TODO: add keyTest/Example files :
.*test.*, .*example.*, .*sample.*Comments :
//, #, /*, *Environment variable references (correct usage):
process.env.API_KEYimport.meta.env.VITE_API_KEYDeno.env.get('API_KEY')Use --exclude to skip additional patterns if needed.
This skill works with standard repomix:
Default usage (no config):
python3 scripts/safe_pack.py ./project
With repomix config :
python3 scripts/safe_pack.py \
./project \
--config repomix.config.json
Custom output location :
python3 scripts/safe_pack.py \
./project \
--output ~/Downloads/package-clean.xml
The skill runs repomix internally after security validation, passing through config and output options.
# Scan and pack in one command
python3 scripts/safe_pack.py \
~/workspace/my-project \
--output ~/Downloads/my-project-package.xml
# Step 1: Scan to discover secrets
python3 scripts/scan_secrets.py ~/workspace/my-project
# Step 2: Review findings and replace credentials with env vars
# (Edit files manually or with automation)
# Step 3: Verify cleanup
python3 scripts/scan_secrets.py ~/workspace/my-project
# Step 4: Package safely
python3 scripts/safe_pack.py \
~/workspace/my-project \
--output ~/Downloads/my-project-clean.xml
# Pre-commit hook: scan for secrets
python3 scripts/scan_secrets.py . --json
# Exit code 1 if secrets found (blocks commit)
# Exit code 0 if clean (allows commit)
References :
references/common_secrets.md - Complete credential pattern catalogScripts :
scripts/scan_secrets.py - Standalone security scannerscripts/safe_pack.py - Complete scan → pack workflowRelated Skills :
repomix-unmixer - Extracts files from repomix packagesskill-creator - Creates new Claude Code skillsThis skill detects common patterns but may not catch all credential types. Always:
Not a replacement for : Secret scanning in CI/CD, git history scanning, or comprehensive security audits.
Weekly Installs
76
Repository
GitHub Stars
628
First Seen
Jan 21, 2026
Security Audits
Gen Agent Trust HubFailSocketPassSnykFail
Installed on
claude-code61
opencode55
codex52
gemini-cli51
cursor48
github-copilot44
agent-browser 浏览器自动化工具 - Vercel Labs 命令行网页操作与测试
157,400 周安装
shadcn-ui 专家指南:React 组件库安装、定制与最佳实践
379 周安装
App Store Connect 提交健康检查指南:减少审核失败,监控构建状态
386 周安装
UI设计模式指南:现代Web/移动应用界面组件、交互模式与可访问性最佳实践
382 周安装
Zustand适配器:为json-render提供状态管理后端,支持嵌套切片与Zustand v5+
389 周安装
隐私政策生成器 - 专业数据隐私合规专家,起草全面合规的隐私政策
391 周安装
App Store Connect 发布流程自动化工具:asc-release-flow 使用指南
387 周安装