AUTONOMOUS REVIEW LOOP / Trail of Bits
Code improver
Pins the generic review loop that will not choose a reviewer, will not start on an unconfirmed scope, and will not commit.
“Asks for a named reviewer and scope confirmation, refuses an inline fix loop, and does not commit.”
01 / THE REASONING
Why this made the selection.
- The user must name the reviewer, there is no default, and a missing name is a question rather than a guess.
- Scope is confirmed before launch, an unavailable workflow is not replaced inline, and the loop never commits.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/code-improver/skills/code-improver/SKILL.md
- plugins/code-improver/README.md
- README.md
- LICENSE
Our findings
- There is no default reviewer, and if none was named the skill says to ask rather than pick one.
- If the user did not give a scope, the skill proposes the target directory glob and says to confirm before launching.
- If the workflow tool is unavailable or denied, the skill says to stop and not improvise the loop with direct edits.
- A reviewer-unavailable halt is relayed, and the skill says not to review the target yourself.
- The loop never commits; changes stay in the working tree.
- A capped result must be said plainly as not converged, and must not be presented as success.
- Answering that the loop is running and will be reported later is treated as losing the run.
Not established by this review
- The resource was not executed.
- The workflow was not launched and no repository was edited or initialized.
- workflows/improve.js and agents/fixer.md were not opened.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README shows `/plugin marketplace add trailofbits/skills`. That adds the marketplace, not this skill.
- The same README shows `/plugin menu` for browsing plugins. It does not name an install line for this file.
- The code-improver README describes the loop and does not contain an install command. Codex marketplace lines in the repository README also add the marketplace rather than this skill.
Before you start
- Claude Code with dynamic-workflow support, as the plugin README states
- A target directory and a reviewer the user names; the skill says not to invent either
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Code improver SKILL.md ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/code-improver/SKILL.md
Supports: Stop rules for a missing workflow or reviewer, no commit, and a capped result is not success
- code-improver README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md
Supports: Claude Code is required for the loop, and a non-repository target is initialized loudly
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: Marketplace install line and the CC-BY-SA-4.0 statement
- Repository LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Attribution-ShareAlike 4.0 International Public License