repomix-explorer
Analyze or explore a codebase (remote or local repository) by packing it with the Repomix CLI, then reading and searching the generated output. Use when the user wants a high-level understanding of an unfamiliar or large repo, not a targeted edit. Trigger for: - Structure/overview: "analyze this repo", "what's the structure", "explain this codebase", "what's in vercel/next.js" - Pattern discovery across many files: "find all auth code", "where are the API endpoints", "show me all React components" - Metrics: "how many files/tokens", "largest files", "TypeScript vs JavaScript ratio" - Remote repos: any github.com URL or "owner/repo" the user wants explored DO NOT trigger for: - Editing, refactoring, or writing code in the current project - Reading or searching a known file/path in the local project (use Read or grep directly) - Single-symbol lookups in the local project answerable with one grep - Git operations, running tests, builds, or installs
66
79%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Fix and improve this skill with Tessl
tessl review fix ./skills/repomix-explorer/SKILL.mdLow
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow for remote repository analysis (`npx repomix@latest --remote <repo> ...` then “Analyze the generated output file”) entails reading repomix’s generated XML which can contain outsider-authored source text from the fetched public repository, and that XML is then ingested by the agent for analysis (free-form code/text from third parties).
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill explicitly runs npx repomix@latest --remote <repo> which fetches and executes remote code and repository content at runtime (examples: yamadashy/repomix, facebook/react, and https://github.com/microsoft/vscode), and that fetched content is used to generate the outputs the agent ingests, so it directly influences prompts/execution.
- Repository
- yamadashy/repomix
- Commit
c898ff0
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.