跳到主要内容
知仓学习社ZHICANG

repomix

Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude …

读凭据执行命令读文件严重 34 · 高危 11mrgoonie/claudekit-skills

它会碰到什么

扫了多少8 个文本文件,52 KB
它会碰到什么读凭据执行命令读文件
命中总数47 处
命中统计严重 34 · 高 11 · 中 2 · 低 0
逐条看命中(30 条严重或高危)
  • 严重 references/configuration.md:109cred-paths
    # Sensitive files
  • 严重 scripts/README.md:14cred-paths
    - Environment variable loading from multiple .env file locations
  • 严重 scripts/README.md:87cred-paths
    Loads .env files in order of precedence:
  • 严重 scripts/README.md:89cred-paths
    2. `./repomix/.env` (skill-specific)
  • 严重 scripts/README.md:90cred-paths
    3. `./skills/.env` (skills directory)
  • 严重 scripts/README.md:91cred-paths
    4. `./.claude/.env` (lowest priority)
  • 严重 scripts/repomix_batch.py:6cred-paths
    Supports configuration through environment variables loaded from multiple .env file locations.
  • 严重 scripts/repomix_batch.py:32cred-paths
    """Load environment variables from multiple .env file locations."""
  • 严重 scripts/repomix_batch.py:37cred-paths
    Load environment variables from .env files in order of precedence.
  • 严重 scripts/repomix_batch.py:39cred-paths
    Order: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/repomix_batch.py:39cred-paths
    Order: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/repomix_batch.py:39cred-paths
    Order: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/repomix_batch.py:49cred-paths
    script_dir.parent.parent.parent / ".env",  # .claude/.env
  • 严重 scripts/repomix_batch.py:49cred-paths
    script_dir.parent.parent.parent / ".env",  # .claude/.env
  • 严重 scripts/repomix_batch.py:50cred-paths
    script_dir.parent.parent / ".env",          # skills/.env
  • 严重 scripts/repomix_batch.py:50cred-paths
    script_dir.parent.parent / ".env",          # skills/.env
  • 严重 scripts/repomix_batch.py:51cred-paths
    script_dir.parent / ".env",                 # skill/.env (repomix/.env)
  • 严重 scripts/repomix_batch.py:51cred-paths
    script_dir.parent / ".env",                 # skill/.env (repomix/.env)
  • 严重 scripts/repomix_batch.py:51cred-paths
    script_dir.parent / ".env",                 # skill/.env (repomix/.env)
  • 严重 scripts/repomix_batch.py:67cred-paths
    Parse a .env file and return key-value pairs.
  • 严重 scripts/repomix_batch.py:70cred-paths
    path: Path to .env file
  • 严重 scripts/tests/test_repomix_batch.py:65cred-paths
    """Test parsing basic .env file."""
  • 严重 scripts/tests/test_repomix_batch.py:66cred-paths
    env_file = tmp_path / ".env"
  • 严重 scripts/tests/test_repomix_batch.py:73cred-paths
    """Test parsing .env file with quoted values."""
  • 严重 scripts/tests/test_repomix_batch.py:74cred-paths
    env_file = tmp_path / ".env"
  • 严重 scripts/tests/test_repomix_batch.py:81cred-paths
    """Test parsing .env file with comments."""
  • 严重 scripts/tests/test_repomix_batch.py:82cred-paths
    env_file = tmp_path / ".env"
  • 严重 scripts/tests/test_repomix_batch.py:89cred-paths
    """Test parsing .env file with empty lines."""
  • 严重 scripts/tests/test_repomix_batch.py:90cred-paths
    env_file = tmp_path / ".env"
  • 严重 scripts/tests/test_repomix_batch.py:97cred-paths
    """Test parsing .env file with equals sign in value."""

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Repomix Skill

Repomix packs entire repositories into single, AI-friendly files. Perfect for feeding codebases to LLMs like Claude, ChatGPT, and Gemini.

When to Use

Use when:

  • Packaging codebases for AI analysis
  • Creating repository snapshots for LLM context
  • Analyzing third-party libraries
  • Preparing for security audits
  • Generating documentation context
  • Investigating bugs across large codebases
  • Creating AI-friendly code representations

Quick Start

Check Installation

repomix --version

Install

# npm
npm install -g repomix

# Homebrew (macOS/Linux)
brew install repomix

Basic Usage

# Package current directory (generates repomix-output.xml)
repomix

# Specify output format
repomix --style markdown
repomix --style json

# Package remote repository
npx repomix --remote owner/repo

# Custom output with filters
repomix --include "src/**/*.ts" --remove-comments -o output.md

Core Capabilities

Repository Packaging

  • AI-optimized formatting with clear separators
  • Multiple output formats: XML, Markdown, JSON, Plain text
  • Git-aware processing (respects .gitignore)
  • Token counting for LLM context management
  • Security checks for sensitive information

Remote Repository Support

Process remote repositories without cloning:

# Shorthand
npx repomix --remote yamadashy/repomix

# Full URL
npx repomix --remote https://github.com/owner/repo

# Specific commit
npx repomix --remote https://github.com/owner/repo/commit/hash

Comment Removal

Strip comments from supported languages (HTML, CSS, JavaScript, TypeScript, Vue, Svelte, Python, PHP, Ruby, C, C#, Java, Go, Rust, Swift, Kotlin, Dart, Shell, YAML):

repomix --remove-comments

Common Use Cases

Code Review Preparation

# Package feature branch for AI review
repomix --include "src/**/*.ts" --remove-comments -o review.md --style markdown

Security Audit

# Package third-party library
npx repomix --remote vendor/library --style xml -o audit.xml

Documentation Generation

# Package with docs and code
repomix --include "src/**,docs/**,*.md" --style markdown -o context.md

Bug Investigation

# Package specific modules
repomix --include "src/auth/**,src/api/**" -o debug-context.xml

Implementation Planning

# Full codebase context
repomix --remove-comments --copy

Command Line Reference

File Selection

# Include specific patterns
repomix --include "src/**/*.ts,*.md"

# Ignore additional patterns
repomix -i "tests/**,*.test.js"

# Disable .gitignore rules
repomix --no-gitignore

Output Options

# Output format
repomix --style markdown  # or xml, json, plain

# Output file path
repomix -o output.md

# Remove comments
repomix --remove-comments

# Copy to clipboard
repomix --copy

Configuration

# Use custom config file
repomix -c custom-config.json

# Initialize new config
repomix --init  # creates repomix.config.json

Token Management

Repomix automatically counts tokens for individual files, total repository, and per-format output.

Typical LLM context limits:

  • Claude Sonnet 4.5: ~200K tokens
  • GPT-4: ~128K tokens
  • GPT-3.5: ~16K tokens

Security Considerations

Repomix uses Secretlint to detect sensitive data (API keys, passwords, credentials, private keys, AWS secrets).

Best practices:

  1. Always review output before sharing
  2. Use .repomixignore for sensitive files
  3. Enable security checks for unknown codebases
  4. Avoid packaging .env files
  5. Check for hardcoded credentials

Disable security checks if needed:

repomix --no-security-check

Implementation Workflow

When user requests repository packaging:

  1. Assess Requirements
  • Identify target repository (local/remote)
  • Determine output format needed
  • Check for sensitive data concerns
  1. Configure Filters
  • Set include patterns for relevant files
  • Add ignore patterns for unnecessary files
  • Enable/disable comment removal
  1. Execute Packaging
  • Run repomix with appropriate options
  • Monitor token counts
  • Verify security checks
  1. Validate Output
  • Review generated file
  • Confirm no sensitive data
  • Check token limits for target LLM
  1. Deliver Context
  • Provide packaged file to user
  • Include token count summary
  • Note any warnings or issues

Reference Documentation

For detailed information, see:

  • [Configuration Reference](./references/configuration.md) - Config files, include/exclude patterns, output formats, advanced options
  • [Usage Patterns](./references/usage-patterns.md) - AI analysis workflows, security audit preparation, documentation generation, library evaluation

Additional Resources

  • GitHub: https://github.com/yamadashy/repomix
  • Documentation: https://repomix.com/guide/
  • MCP Server: Available for AI assistant integration

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。