The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and package external repositories (local or remote) to be used as context for an AI agent. This creates a surface for indirect prompt injection, where malicious instructions embedded in a target codebase could be interpreted by the agent after the code is packaged.
Ingestion points: The scripts/repomix_batch.py script accepts repository paths and URLs via command-line arguments and JSON configuration files.
Boundary markers: While the repomix tool uses XML/Markdown tags to structure the output, the skill lacks specific instructions for the agent to treat the packaged content as untrusted data.
Capability inventory: The skill can read local files and fetch remote repositories using the repomix CLI via subprocess.run.
Sanitization: The skill includes a secret scanning check (Secretlint), but it does not provide sanitization or filtering for potential prompt injection patterns in the processed data.
[COMMAND_EXECUTION]: The scripts/repomix_batch.py script dynamically constructs and executes commands to run the repomix CLI.
The script uses subprocess.run with a list of arguments. While this avoids shell injection, it directly incorporates user-supplied repository paths and output filenames as command arguments.
The script provides an option (--no-security-check) that allows users to disable the tool's integrated secret scanner.
[DATA_EXFILTRATION]: The skill contains logic and artifacts that risk exposing sensitive system information.
The binary file scripts/.coverage (a SQLite database) contains code coverage metadata that leaks absolute file paths (e.g., /mnt/d/www/claudekit/...), revealing the author's internal directory structure.
The EnvLoader class in scripts/repomix_batch.py automatically searches for and loads .env files from several parent directory levels, including the agent's configuration directories (e.g., .claude/.env). This behavior could lead to the unintentional loading and exposure of sensitive credentials to the subprocess environment.
[EXTERNAL_DOWNLOADS]: The skill relies on and facilitates the execution of the repomix tool from the npm registry.
The repomix_batch.py script uses npx repomix for remote repository processing, which triggers the download and execution of the package from the npm registry at runtime.

repomix