Skip to content
T1KTheOneKit

t1k:repomix

FieldValue
Modulet1k-maintainer
Version3.2.1
Effortmedium
Tools—

Keywords: codebase, llm-context, pack, repomix, snapshot

How to invoke

Section titled “How to invoke”
/t1k:repomix
[path] [--format xml|md|txt]

Repomix Skill

Section titled “Repomix Skill”

Repomix packs entire repositories into single, AI-friendly files. Perfect for feeding codebases to LLMs like Claude, ChatGPT, and Gemini.

When to Use

Section titled “When to Use”

Use when:

  • Packaging codebases for AI analysis
  • Creating repository snapshots for LLM context
  • Analyzing third-party libraries
  • Preparing for security audits
  • Generating documentation context
  • Investigating bugs across large codebases
  • Creating AI-friendly code representations

Quick Start

Section titled “Quick Start”
Terminal window
repomix --version                     # check installation
npm install -g repomix                # or: brew install repomix


repomix                               # package current dir -> repomix-output.xml
repomix --style markdown              # or --style json
npx repomix --remote owner/repo       # package a remote repo without cloning
repomix --include "src/**/*.ts" --remove-comments -o output.md

Core Capabilities

Section titled “Core Capabilities”
  • AI-optimized formatting with clear separators; XML, Markdown, JSON, and plain-text output
  • Git-aware processing (respects .gitignore); token counting for LLM context sizing
  • Security checks for sensitive information (Secretlint) before the pack leaves the machine
  • Remote-repository packing without a local clone; per-language comment stripping

Full CLI flags, config-file schema, glob patterns, output-format tradeoffs, and remote/comment options: Configuration Reference. Worked recipes per scenario (code review, security audit, doc generation, library evaluation, CI/CD, troubleshooting): Usage Patterns.

Security Considerations

Section titled “Security Considerations”

Repomix uses Secretlint to detect sensitive data (API keys, passwords, credentials, private keys, AWS secrets). Always review output before sharing, use .repomixignore for sensitive files, and avoid packaging .env files. --no-security-check disables the scan — see the T1K guard below before ever using it.

Implementation Workflow

Section titled “Implementation Workflow”

When user requests repository packaging:

  1. Assess Requirements — target repo (local/remote), output format, sensitive-data concerns
  2. Configure Filters — include/ignore patterns, comment removal
  3. Execute Packaging — run repomix, monitor token counts, verify security checks
  4. Validate Output — review generated file, confirm no sensitive data, check token limits
  5. Deliver Context — hand off the packaged file, token-count summary, and any warnings

Reference Documentation

Section titled “Reference Documentation”
  • Configuration Reference — config files, include/exclude patterns, output formats, token counting, remote repos, advanced options
  • Usage Patterns — AI analysis workflows, security audit preparation, documentation generation, library evaluation, CI/CD integration, troubleshooting

Additional Resources

Section titled “Additional Resources”

Tool Size Caps + Security Guards (E6)

Section titled “Tool Size Caps + Security Guards (E6)”

When invoking repomix, this skill MUST enforce the following caps on every run:

  • Output size cap: default --max-output-size 8MB (8 × 1024 × 1024 chars). Larger packs do not fit a single LLM context anyway. Override only when the user explicitly requests --no-output-size-cap.
  • Token-count guard: if the post-pack token estimate exceeds 200_000, refuse to deliver the file inline; instead write the path and report 'too large to inline; opened on disk at <path>'.
  • Security check is FAIL-CLOSED, not fail-open: the historical --no-security-check flag is a fail-OPEN default that ships secret-laden packs. This skill MUST pass --security-check (default), and MUST refuse --no-security-check unless the user types the literal phrase I accept secret leak risk in the same turn.
  • Guarded write: packed file goes to os.tmpdir()/t1k-repomix/<sha>.{xml,md,txt} first; only after the security-check passes does the skill copy to the user-specified output path. Failure path leaves nothing in the destination.

These caps protect downstream consumers (LLM context budgets) and prevent the most common failure mode (accidentally packing .env or credential files into a session).