overnight-repo-auditor

Audits an entire codebase overnight across security, performance, accessibility, dependencies, and code quality.

1|Updated Aug 8, 2026
One-click install
npx skills add https://github.com/th-efool/SKILLS --skill overnight-repo-auditor-th-efool
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: overnight-repo-auditor
Source: https://github.com/th-efool/SKILLS/tree/main/overnight-repo-auditor
Command: npx skills add https://github.com/th-efool/SKILLS --skill overnight-repo-auditor-th-efool

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Manually auditing a large codebase for security holes, performance bottlenecks, accessibility gaps, outdated dependencies, and code quality issues takes days of engineering time and is rarely exhaustive. This Skill runs an autonomous multi-agent audit over a long runtime window and delivers a single severity-rated report. ## Core Features & Use Cases - Parallel Specialist Agents: Deploys five audit agents (Security, Performance, Accessibility, Dependency, Code Quality) simultaneously, each writing structured findings to its own report file. - Severity-Rated Findings: Every issue is rated Critical/High/Medium/Low using a shared rubric, then deduplicated and compiled into an executive summary with a top-10 priority list and sprint plan. - Scales to Large Repos: Handles codebases from under 10K lines to 500K+ lines by spawning sub-agents for file-batch parallelization. - Use Case: Point it at a legacy monorepo before a major refactor; wake up to overnight-audit-report.md containing every SQL injection risk, N+1 query, WCAG violation, and vulnerable dependency ranked by severity. ## Quick Start Run an overnight audit of this repository covering security, performance, accessibility, dependencies, and code quality, and write the compiled report to overnight-audit-report.md.

Frequently Asked Questions about overnight-repo-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit an entire codebase for security vulnerabilities automatically?▼

Deploy the Security Auditor agent, which works through a 10-category checklist covering secrets, injection, authentication, data exposure, cryptography, and API security. It reads every relevant file rather than sampling and writes findings to audit-workspace/01-security-audit.md.

How to run a codebase audit overnight with AI agents?▼

Invoke the skill on your repository and it runs three phases: reconnaissance to map the tech stack, parallel deployment of five specialist audit agents in the background, then compilation into overnight-audit-report.md with an executive summary and prioritized action plan.

Can I audit only security and dependencies instead of the full codebase review?▼

Yes, targeted runs are supported. Request specific modules such as "security and dependencies only" and only those agents are deployed, with only their sections included in the final report.

Does the accessibility audit work on backend-only repositories?▼

No, the Accessibility Auditor is skipped when reconnaissance finds no frontend files such as HTML, JSX, TSX, Vue, or Svelte templates. A placeholder noting "Not Applicable" is written instead.

What happens if one audit agent fails during the overnight run?▼

The failed agent is retried once with the same brief. If it fails again, a partial report noting the failure is written, the other agents continue unaffected, and the lost coverage is documented in the final report.

What are the limitations of a static analysis codebase audit?▼

Static analysis does not cover runtime behavior, real performance metrics, or accessibility testing with actual assistive technology users. It does not replace professional penetration testing, load testing, or manual accessibility audits.