Overnight Repo Auditor

Overnight Repo Auditor

Autonomously audit an entire codebase overnight and produce a single severity-rated report covering security, performance, accessibility, dependencies, and code quality. Built for Anthropic's Managed Agents runtime (14.5-hour task horizon): run to completion without questions or confirmation, writing structured findings to disk as execution proceeds so partial results survive interruption.

Contents

• references/reconnaissance.md -- Phase 1 steps and the reconnaissance report template.
• references/shared-rubric.md -- Severity rating rubric and structured finding format. Pass both to every agent.
• references/agent-security.md -- Security Auditor brief and output format.
• references/agent-performance.md -- Performance Auditor brief and output format.
• references/agent-accessibility.md -- Accessibility Auditor brief, skip condition, and output format.
• references/agent-dependency.md -- Dependency Auditor brief, skip condition, and output format.
• references/agent-code-quality.md -- Code Quality Auditor brief and output format.
• references/compilation-and-templates.md -- Phase 3 compilation steps, final report template, and completion message.

Operating Rules

• Run autonomously. Never ask the user for input. When a decision is ambiguous, choose the more thorough option and document the choice in the report.
• Read-only against source. Create only the audit-workspace/ directory and overnight-audit-report.md. Never modify, build, or execute project code. The sole exception: the Dependency Auditor may run read-only package-audit commands (npm audit, pip audit, and equivalents).
• Be exhaustive, not sampling-based, while the time window allows.

Workflow

Phase 1: Reconnaissance (sequential, ~5-10 min)

1. Scan repository structure, identify languages, frameworks, config files, and estimate lines of code.
2. Determine which audit modules are relevant (Security and Code Quality always; Performance always; Accessibility only with frontend/template files; Dependency only with a manifest/lockfile).
3. Write audit-workspace/00-reconnaissance.md as the shared context document for all agents.

Follow references/reconnaissance.md for exact commands and the report template.

Phase 2: Parallel Audit Deployment

4. Deploy every relevant audit agent simultaneously via the Agent tool. Use run_in_background: true on every call and send ALL agent calls in a single message.
5. Build each agent's prompt by combining: the full reconnaissance report (paste inline -- agents do not share filesystem context automatically), the severity rubric and finding format from references/shared-rubric.md, and the agent-specific brief from its reference file. Each agent writes to its own output file under audit-workspace/.
   • Security -> references/agent-security.md -> 01-security-audit.md
   • Performance -> references/agent-performance.md -> 02-performance-audit.md
   • Accessibility -> references/agent-accessibility.md -> 03-accessibility-audit.md (honor skip condition)
   • Dependency -> references/agent-dependency.md -> 04-dependency-audit.md (honor skip condition)
   • Code Quality -> references/agent-code-quality.md -> 05-code-quality-audit.md