The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The EnvLoader class in scripts/repomix_batch.py is designed to harvest environment variables from multiple levels of the directory tree, specifically targeting sensitive files like .claude/.env. This can lead to the exposure of platform-level credentials to external processes.\n- [COMMAND_EXECUTION]: The script scripts/repomix_batch.py uses subprocess.run to execute CLI commands. It accepts repository paths and configuration from user-supplied input and JSON files, which are interpolated into command arguments without sufficient sanitization, posing a risk of command injection.\n- [REMOTE_CODE_EXECUTION]: The skill documentation and the scripts/repomix_batch.py script facilitate the execution of remote repository content using the npx repomix --remote command, allowing arbitrary remote code to be processed and potentially executed.\n- [EXTERNAL_DOWNLOADS]: The skill encourages downloading and processing repositories from remote URLs as a core feature, which involves fetching external data and code into the local environment.\n- [OBFUSCATION]: The skill includes a binary SQLite file at scripts/.coverage. Binary files are opaque and non-human-readable, which can be used to conceal malicious data or payloads within a skill package.\n- [INDIRECT_PROMPT_INJECTION]: The skill packages large amounts of untrusted repository data for LLM consumption, creating a vulnerability surface where hidden instructions in the source code could influence the agent.\n
Ingestion points: Local and remote repository files processed by the repomix CLI.\n
Boundary markers: Uses XML, Markdown, or JSON tags to delimit files but does not include explicit instructions to the agent to ignore nested prompts.\n
Capability inventory: File system access, network access for remote repos, and shell command execution.\n
Sanitization: Includes an optional security scanner (Secretlint) that can be disabled via the --no-security-check flag.

repomix