--- title: "Code improver: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-code-improver/ description: "Pins the generic review loop that will not choose a reviewer, will not start on an unconfirmed scope, and will not commit." --- # Code improver: review, setup & limitations · Undominated.ai > Pins the generic review loop that will not choose a reviewer, will not start on an unconfirmed scope, and will not commit. [← Explore all skills](/skills/) AUTONOMOUS REVIEW LOOP / Trail of Bits # Code improver Pins the generic review loop that will not choose a reviewer, will not start on an unconfirmed scope, and will not commit. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/code-improver) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “Asks for a named reviewer and scope confirmation, refuses an inline fix loop, and does not commit.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/code-improver/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The user must name the reviewer, there is no default, and a missing name is a question rather than a guess. - Scope is confirmed before launch, an unavailable workflow is not replaced inline, and the loop never commits. ### A good fit for - Improving a directory with a reviewer the user names, after the scope glob is confirmed and the workflow file is actually found ### Weigh up before choosing - The resource was not executed. - `/plugin marketplace add trailofbits/skills` adds the marketplace, not this skill and not the code-improver plugin. - No fetched line installs only this file. The code-improver README has no install command. - The plugin README says clients other than Claude Code, with Codex named, are not supported for the loop even if the skills load. - The plugin README says a target that is not already a git repository is initialized, with a named baseline identity, and that this is said loudly. The skill file says the result notes can carry that warning. This review did not run that path. - workflows/improve.js and agents/fixer.md were not opened. The skill says the ledger, scope guard, and escalation behavior live there. - The skill says not to end the turn while the loop runs, and also that an interactive completion notification re-invokes the agent. The following sentence treats an answer of reporting later as losing the run. Those were read as one ban on abandoning the run, not as two procedures. - A one-time review or a single edit is explicitly out of scope; the file points those at the reviewer or a direct edit. - The recorded command adds the Trail of Bits marketplace. It does not install code-improver or this skill. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/code-improver/skills/code-improver/SKILL.md - plugins/code-improver/README.md - README.md - LICENSE ### Our findings - There is no default reviewer, and if none was named the skill says to ask rather than pick one. - If the user did not give a scope, the skill proposes the target directory glob and says to confirm before launching. - If the workflow tool is unavailable or denied, the skill says to stop and not improvise the loop with direct edits. - A reviewer-unavailable halt is relayed, and the skill says not to review the target yourself. - The loop never commits; changes stay in the working tree. - A capped result must be said plainly as not converged, and must not be presented as success. - Answering that the loop is running and will be reported later is treated as losing the run. ### Not established by this review - The resource was not executed. - The workflow was not launched and no repository was edited or initialized. - workflows/improve.js and agents/fixer.md were not opened. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) DOCUMENTED COMMAND /plugin marketplace add trailofbits/skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The repository README shows `/plugin marketplace add trailofbits/skills`. That adds the marketplace, not this skill. - The same README shows `/plugin menu` for browsing plugins. It does not name an install line for this file. - The code-improver README describes the loop and does not contain an install command. Codex marketplace lines in the repository README also add the marketplace rather than this skill. ### Before you start - Claude Code with dynamic-workflow support, as the plugin README states - A target directory and a reviewer the user names; the skill says not to invent either ### Compatibility Claude Code ### Local skill text; the loop edits a working tree and does not commit only if an operator runs it - Read the skill text - Edit the working tree only if the operator runs the workflow - Do not treat an improvised inline loop as the workflow ### Cost model CC-BY-SA-4.0; no marketplace install and no workflow run. Share-alike applies to a redistributed adaptation. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Code improver SKILL.md ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/code-improver/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/code-improver/SKILL.md Supports: Stop rules for a missing workflow or reviewer, no commit, and a capped result is not success - [code-improver README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md Supports: Claude Code is required for the loop, and a non-repository target is initialized loudly - [Repository README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: Marketplace install line and the CC-BY-SA-4.0 statement - [Repository LICENSE ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: Attribution-ShareAlike 4.0 International Public License KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### PR improver ↗ Pins the branch loop that refuses the base branch, stops on an empty diff, will not replace a missing reviewer, and does not commit.](/skills/trailofbits-pr-improver/)[### Skill improver ↗ Pins the skill loop that stops when plugin-dev is missing, refuses an inline rewrite, and does not commit.](/skills/trailofbits-skill-improver/)[### Django performance review ↗ Review Django code and report only performance issues the reviewer traced. Zero findings is an allowed result.](/skills/getsentry-django-perf-review/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)