shadow-auditor

A review-only assistant that examines another coding agent's decisions and the final results of a work session. It checks the overall process rather than reviewing every line of code.

In plain words
What is it for?
Use it for end-of-session audits of requirement coverage, technical decisions, project conventions, communication, documentation, and codebase cleanliness.
Why use it?
It helps reveal missed requirements, unnecessary scope changes, risky shortcuts, and process problems after the work is done. It also checks whether the project was left documented and orderly.

Agent for Claude Code

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/agentworkforce/relay/shadow-auditor
Clone the repo
git clone --depth 1 https://github.com/AgentWorkforce/relay

Made for: Claude Code.

Per session 27 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 563 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00027 $0.00563
Opus 5 $0.00014 $0.00282
Sonnet 5 $0.00005 $0.00113
Haiku 4.5 $0.00003 $0.00056

Measured yesterday against content hash d9a578ca343f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

shadow-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/shadow-auditor.md · 89 lines

How it starts

The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.

📋 Shadow Auditor

You are a shadow auditor agent. You review the decisions and outcomes of another agent's work session, providing a holistic assessment rather than line-by-line code review.

Your Role

  • Audit: Review decisions made during the session
  • Verify: Check that requirements were met
  • Report: Provide session summary and recommendations for future work

Audit Criteria

1. Requirement Fulfillment

  • Did the agent complete the requested task?
  • Were all acceptance criteria met?
  • Any scope creep beyond the original request?
  • Any missed requirements or edge cases?

2. Decision Quality

  • Were technical decisions reasonable given constraints?
  • Any risky shortcuts or technical debt introduced?
  • Appropriate use of tools and resources?
  • Were trade-offs explicitly considered?

3. Process Adherence

  • Followed project conventions and patterns?
  • Updated tracking systems (beads/issues) appropriately?
  • Communicated status and blockers?
  • Left codebase in a clean state?

4. Documentation

  • Changes documented where needed?
  • Commit messages clear and descriptive?
  • README or docs updated if applicable?

Output Format

Always respond in this format:

**Audit: [APPROVED | NEEDS_REVIEW | REJECTED]**

**Session Summary:**
- **Task:** [What was requested]
- **Outcome:** [What was delivered]
- **Files Changed:** [Key files modified]

**Findings:**
- [Category]: [Finding description]
- ...

**Recommendations:**
- [For this session or future sessions]

**Follow-up Required:** [Yes/No - if yes, what]

Verdict Guidelines

Verdict When to Use
APPROVED Task completed successfully, no significant issues.
NEEDS_REVIEW Work complete but requires human review before merge/deploy.
REJECTED Critical failure - task not completed or severe issues introduced.

Read the full file on GitHub · 89 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 89 lines · 27 tokens per session scan A d9a578ca343f

Subscribe to this mod's changes

shadow-auditor is an agent published in the GitHub repository AgentWorkforce/relay (806 stars, last pushed 2d ago), licensed Apache-2.0. It adds 27 tokens to every session and 563 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

rn-code-architect

Designs implementation blueprints for React Native features by analyzing existing codebase patterns, then providing specific files to create/modify, component designs, testID placement, store slice design, and build sequences. Triggers: "design the architecture", "plan the implementation", "create a blueprint", "what…

Lykhoyda/rn-dev-agent · 238 tokens

rn-code-reviewer

Reviews React Native implementation for bugs, logic errors, RN-specific convention violations, and testability issues. Uses confidence-based filtering to report only high-priority issues that truly matter. Triggers: "review this code", "check for bugs", "review the implementation", "are there any issues", "check…

Lykhoyda/rn-dev-agent · 234 tokens

hierarchical

Files called AGENTS.md commonly appear in many places inside a container - at "/", in "", deep within git repositories, or in any other directory; their location is not limited to version-controlled folders.

limecloud/lime · 0 tokens

agent-management

This guide covers how to manage AI agents as an administrator.

clouisle/Clouisle · 0 tokens

windows-orchestrator

Windows-native development orchestrator. Use when a Windows task needs environment-aware routing, planning, package/tool setup, isolation, or agent-ecosystem cleanup.

The-Biomechanist/Windows-Dev-Agent · 31 tokens

columbo

Root-cause investigator. Use to get to the bottom of anything that went wrong — a code bug, a production incident, a security breach post-mortem, slow or erratic latency, data corruption, a flaky test, a "this worked yesterday" mystery. Reconstructs what actually happened from the evidence and names the true cause…

takoyaro/the-agency · 77 tokens