PULL REQUEST REPAIR / Trail of Bits
PR improver
Pins the branch loop that refuses the base branch, stops on an empty diff, will not replace a missing reviewer, and does not commit.
“Refuses the base branch or an empty diff, will not invent the review loop, and does not commit.”
01 / THE REASONING
Why this made the selection.
- The skill refuses to run when the current branch is the base and stops when the diff is empty.
- An unavailable workflow or reviewer stops the run, the skill says not to review the branch in its place, and the loop never commits.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/code-improver/skills/pr-improver/SKILL.md
- plugins/code-improver/README.md
- README.md
- LICENSE
Our findings
- Outside a git repository the skill says to fail loudly.
- It refuses to run when the current branch is the base, because there is no diff to improve.
- An empty name-only diff is a stop, not a review.
- If the workflow tool is unavailable or denied, the skill says to stop and not improvise the loop with direct edits.
- A reviewer-unavailable halt says not to review the branch yourself, and names pr-review-toolkit as the default dependency.
- The loop never commits; changes stay in the working tree.
- A capped result must not be presented as success.
Not established by this review
- The resource was not executed.
- The workflow was not launched and no repository was edited or initialized.
- workflows/improve.js and agents/fixer.md were not opened.
- The external pr-review-toolkit plugin was not fetched.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README shows `/plugin marketplace add trailofbits/skills`. That adds the marketplace, not this skill.
- The same README shows `/plugin menu` for browsing plugins. It does not name an install line for this file.
- The code-improver README describes the loop and does not contain an install command. Codex marketplace lines in the repository README also add the marketplace rather than this skill.
Before you start
- Claude Code with dynamic-workflow support, as the plugin README states
- A git repository that is not already on the base branch
- The pr-review-toolkit reviewer unless the user names a different one
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- PR improver SKILL.md ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/pr-improver/SKILL.md
Supports: Stop rules for a missing workflow or reviewer, no commit, and a capped result is not success
- code-improver README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md
Supports: Claude Code is required for the loop, and a non-repository target is initialized loudly
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: Marketplace install line and the CC-BY-SA-4.0 statement
- Repository LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Attribution-ShareAlike 4.0 International Public License