repomix

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). Repomix's core behavior is to read and concatenate repository files (with tasks for each file) into single outputs and optionally copy or deliver that output, which will include any secrets found verbatim unless explicitly excluded—so the skill effectively requires handling/outputting secret values and even allows disabling security checks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly ingests arbitrary public repositories (e.g., SKILL.md "Remote Repository Support" and usage examples like npx repomix --remote https://github.com/owner/repo) and the batch script (scripts/repomix_batch.py) builds and runs npx repomix --remote <repo> on untrusted GitHub/URL content which the agent packages and is expected to read/interpret as part of its workflow, so third‑party content can materially influence subsequent analysis/actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes repomix at runtime (e.g., via "npx repomix --remote https://github.com/yamadashy/repomix" and other owner/repo or https://github.com/owner/repo inputs) which fetches remote repository content and packages it for LLM consumption, meaning external content fetched at runtime can be injected into model context and thus directly influence prompts/behavior.