repomix-safe-mixer_skill

Overview

This skill safely packages codebases with repomix by automatically detecting and removing hardcoded credentials before packing. It prevents accidental secret leaks by scanning project files, reporting findings with file/line details, and blocking packaging until issues are resolved. Use it to produce distribution-ready packages that do not contain embedded API keys, tokens, or private keys.

How this skill works

The tool provides two scripts: a full workflow (scan → report → pack) and a standalone scanner. The scanner searches for common secret patterns (cloud provider keys, API keys, JWTs, private keys, etc.), respects exclude patterns, and emits human-readable or JSON results. If the scan is clean, the skill invokes repomix to create the package; if secrets are found, packaging is blocked until remediation or a forced override is used.

When to use it

• Packaging code for distribution or public release with repomix
• Creating reference or example packages that must not contain live credentials
• Pre-commit or CI checks to block commits containing hardcoded secrets
• Auditing a repository before sharing with collaborators or third parties
• Verifying cleanup after replacing credentials with environment variables

Best practices

• Replace hardcoded credentials with environment variables and provide a .env.example
• Run the scanner in CI or pre-commit hooks to prevent accidental commits
• Use exclude patterns to skip test/example files that legitimately contain placeholders
• Always manually review findings; the scanner can produce false positives
• Rotate and revoke any credentials that were previously exposed

Example use cases

• Run python3 scripts/safe_pack.py ./project to scan and pack in one step
• Use python3 scripts/scan_secrets.py . --json in CI to block builds with secrets
• Scan a repo, replace keys with import.meta.env or process.env, then re-scan before packaging
• Generate a .env.example from detected keys to document required runtime variables
• Force a package only after conscious review (not recommended) with --force