CODE MAINTENANCE / Trail of Bits
Fixer
Applies dispatched blocking fixes only inside the workflow's scope globs, and records a verdict instead of skipping a finding or discarding the worktree.
“Workflow-only fixer that returns fixed, rejected, or deferred for each dispatched finding and refuses out-of-scope edits and several git commands.”
01 / THE REASONING
Why this made the selection.
- The description limits dispatch to the code-improver workflow and says the agent is not for ad-hoc editing.
- An edit outside the dispatched scope globs is rejected rather than made, and the git-safety rule forbids checkout, stash, reset, clean, and commit.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/code-improver/agents/fixer.md
- plugins/code-improver/README.md
- README.md
- LICENSE
Our findings
- The description says the agent is dispatched by the code-improver workflow only and is not for ad-hoc editing.
- Every dispatched finding needs a verdict. Deferred is for minor or info only, and a critical or major finding is not deferred.
- Only files inside the dispatched scope globs may be touched. An out-of-scope edit is rejected and not made.
- The git-safety rule forbids git checkout --, git stash, git reset, git clean, and git commit. A created file is registered with git add -N so the diff and the scope guard can see it.
- A fix that changes executable behavior needs a test or assertion that fails on the pre-fix code. The file says never to weaken a documented guarantee, threat model, or stated behavior to clear a finding.
Not established by this review
- The resource was not executed and its tools were not called.
- No finding list or git worktree was supplied.
- The improve workflow script was not opened.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Use the role in your project.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README at this pin shows /plugin marketplace add trailofbits/skills as one unindented line. That line adds the marketplace, not this agent.
- The same README shows /plugin menu for browsing plugins. It does not name fixer.md.
- The code-improver README describes /code-improver:improve as the workflow that dispatches this fixer. It has no single-line plugin install command.
Before you start
- Claude Code with the dynamic-workflow support the plugin README requires
- A code-improver dispatch that already names the findings and the scope globs
- A git working tree, which that README says the scope guard diffs against a baseline
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- fixer agent ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/agents/fixer.md
Supports: workflow-only dispatch, scope rejection, and git-safety contract
- Repository root LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: CC-BY-SA-4.0 Attribution-ShareAlike 4.0 International
- code-improver README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md
Supports: this file is the plugin fixer, and the loop is unavailable outside Claude Code
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: marketplace install line and the same CC-BY-SA-4.0 statement