The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/repomix_batch.py script uses subprocess.run to execute the repomix CLI tool and npx. While the script uses list-based command construction to mitigate traditional shell injection, it allows the execution of external binaries and presents a risk of argument injection if repository paths or glob patterns are maliciously crafted.
[CREDENTIALS_UNSAFE]: The EnvLoader class in scripts/repomix_batch.py is designed to search for and parse .env files from multiple levels of parent directories, including paths that may map to the agent's internal configuration directories (e.g., ../../../.env representing .claude/.env). This behavior can inadvertently load and expose sensitive host credentials into the repomix process environment.
[INDIRECT_PROMPT_INJECTION]: The skill's primary functionality is to process data from external local or remote repositories, which serves as a vector for indirect prompt injection if the packaged code contains malicious instructions intended for the analyzing LLM.
Ingestion points: Files are read from local paths or fetched from remote repository URLs via scripts/repomix_batch.py and the repomix CLI.
Boundary markers: The skill documentation in SKILL.md specifies that repomix uses AI-optimized separators and XML-like tags to delimit files, which provides some structure but is not a foolproof security boundary.
Capability inventory: The skill can read arbitrary files, perform network requests to fetch remote repos, and write packaged files to the local filesystem.
Sanitization: The skill incorporates Secretlint for sensitive data detection, but this feature can be bypassed using the --no-security-check flag specified in SKILL.md and scripts/repomix_batch.py.

repomix