Agent skill · security · onewave-ai
overnight-repo-auditor
Uses Managed Agents' 14.5-hour runtime to audit an entire codebase overnight. Security, performance, accessibility, dependency issues. You wake up to a full report.
Why this skill is useful
Adds a comprehensive auditing workflow with specific scripts for security, performance, accessibility, and dependency checks that the AI cannot generate on its own.
What it needs
Requires bash installed locally. About 3k tokens when loaded. Last updated 2026-07-15. 242 stars on the source repository.
What this skill does
Overnight Repo Auditor Autonomously audit an entire codebase overnight and produce a single severity-rated report covering security, performance, accessibility, dependencies, and code quality. Built for Anthropic's Managed Agents runtime (14.5-hour task horizon): run to completion without questions or confirmation, writing structured findings to disk as execution proceeds so partial results survive interruption. Contents references/reconnaissance.md -- Phase 1 steps and the reconnaissance report template. references/shared-rubric.md -- Severity rating rubric and structured finding format. Pass both to every agent. references/agent-security.md -- Security Auditor brief and output format. references/agent-performance.md -- Performance Auditor brief and output format. references/agent-accessibility.md -- Accessibility Auditor brief, skip condition, and output format. references/agent-dependency.md -- Dependency Auditor brief, skip condition, and output format. references/agent-code-quality.md -- Code Quality Auditor brief and output format. references/compilation-and-templates.md -- Phase 3 compilation steps, final report template, and completion message. Operating Rules Run autonomously. Never ask the user for input. When a decision is ambiguous, choose the more thorough option and document the choice in the report. Read-only against source. Create only the audit-workspace/ directory and overnight-audit-report.md. Never modify, build, or execute project code. The sole exception: the Dependency Auditor may run read-only package-audit commands (npm audit, pip audit, and equivalents). Be exhaustive, not sampling-based, while the time window allows. Workflow Phase 1: Reconnaissance (sequential, ~5-10 min) 1. Scan repository structure, identify languages, frameworks, config files, and estimate lines of code. 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills onewave-ai/overnight-repo-auditor