SKILL REVIEW LOOP / Trail of Bits
Skill improver
Pins the skill loop that stops when plugin-dev is missing, refuses an inline rewrite, and does not commit.
“Stops when the skill reviewer is missing, refuses an inline rewrite of the loop, and does not commit.”
01 / THE REASONING
Why this made the selection.
- Several matching skills are a question to the user, and a missing plugin-dev reviewer stops the run instead of a self-review.
- The skill forbids an inline imitation, cites an observed case where that imitation weakened a guarantee, and says the loop never commits.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/code-improver/skills/skill-improver/SKILL.md
- plugins/code-improver/README.md
- README.md
- LICENSE
Our findings
- The plugin-dev plugin must be installed, and several matching skills mean the user is asked to choose.
- If the workflow tool is unavailable or denied, the skill says to stop and not improvise the loop with direct edits.
- It names an observed inline fallback that weakened a documented guarantee, which is the outcome the loop is there to prevent.
- A reviewer-unavailable halt says not to review the skill yourself.
- The loop never commits; changes stay in the working tree.
- Fixes to executable behavior carry pins that fail against the pre-fix code, and an out-of-scope change halts the run.
- A capped result must not be presented as success, and rejections are not re-litigated without new evidence.
Not established by this review
- The resource was not executed.
- The workflow was not launched and no repository was edited or initialized.
- workflows/improve.js and agents/fixer.md were not opened.
- The claude-plugins-official plugin-dev plugin was not fetched.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The repository README shows `/plugin marketplace add trailofbits/skills`. That adds the marketplace, not this skill.
- The same README shows `/plugin menu` for browsing plugins. It does not name an install line for this file.
- The code-improver README describes the loop and does not contain an install command. Codex marketplace lines in the repository README also add the marketplace rather than this skill.
Before you start
- Claude Code with dynamic-workflow support, as the plugin README states
- The plugin-dev skill-reviewer from the claude-plugins-official marketplace, which this review did not install
- A skill directory or a unique skill name; several matches require the user to choose
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill improver SKILL.md ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/skill-improver/SKILL.md
Supports: Stop rules for a missing workflow or reviewer, no commit, and a capped result is not success
- code-improver README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md
Supports: Claude Code is required for the loop, and a non-repository target is initialized loudly
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: Marketplace install line and the CC-BY-SA-4.0 statement
- Repository LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Attribution-ShareAlike 4.0 International Public License