--- title: "Skill improver: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-skill-improver/ description: "Pins the skill loop that stops when plugin-dev is missing, refuses an inline rewrite, and does not commit." --- # Skill improver: review, setup & limitations · Undominated.ai > Pins the skill loop that stops when plugin-dev is missing, refuses an inline rewrite, and does not commit. [← Explore all skills](/skills/) SKILL REVIEW LOOP / Trail of Bits # Skill improver Pins the skill loop that stops when plugin-dev is missing, refuses an inline rewrite, and does not commit. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/skill-improver) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “Stops when the skill reviewer is missing, refuses an inline rewrite of the loop, and does not commit.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/skill-improver/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Several matching skills are a question to the user, and a missing plugin-dev reviewer stops the run instead of a self-review. - The skill forbids an inline imitation, cites an observed case where that imitation weakened a guarantee, and says the loop never commits. ### A good fit for - Iterating a Claude Code skill until the plugin-dev skill-reviewer is installed and the workflow file is found ### Weigh up before choosing - The resource was not executed. - `/plugin marketplace add trailofbits/skills` adds the marketplace, not this skill and not the code-improver plugin. - No fetched line installs only this file. The code-improver README has no install command. - The plugin README says clients other than Claude Code, with Codex named, are not supported for the loop even if the skills load. - The plugin README says a target that is not already a git repository is initialized, with a named baseline identity, and that this is said loudly. The skill file says the result notes can carry that warning. This review did not run that path. - workflows/improve.js and agents/fixer.md were not opened. The skill says the ledger, scope guard, and escalation behavior live there. - The skill says not to end the turn while the loop runs, and also that an interactive completion notification re-invokes the agent. The following sentence treats an answer of reporting later as losing the run. Those were read as one ban on abandoning the run, not as two procedures. - The default scope is the skill's plugin directory unless the user passes a different scope. - A one-time review is out of scope and is pointed at the plugin-dev skill-reviewer directly. - The recorded command adds the Trail of Bits marketplace. It does not install skill-improver, plugin-dev, or this skill. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/code-improver/skills/skill-improver/SKILL.md - plugins/code-improver/README.md - README.md - LICENSE ### Our findings - The plugin-dev plugin must be installed, and several matching skills mean the user is asked to choose. - If the workflow tool is unavailable or denied, the skill says to stop and not improvise the loop with direct edits. - It names an observed inline fallback that weakened a documented guarantee, which is the outcome the loop is there to prevent. - A reviewer-unavailable halt says not to review the skill yourself. - The loop never commits; changes stay in the working tree. - Fixes to executable behavior carry pins that fail against the pre-fix code, and an out-of-scope change halts the run. - A capped result must not be presented as success, and rejections are not re-litigated without new evidence. ### Not established by this review - The resource was not executed. - The workflow was not launched and no repository was edited or initialized. - workflows/improve.js and agents/fixer.md were not opened. - The claude-plugins-official plugin-dev plugin was not fetched. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) DOCUMENTED COMMAND /plugin marketplace add trailofbits/skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The repository README shows `/plugin marketplace add trailofbits/skills`. That adds the marketplace, not this skill. - The same README shows `/plugin menu` for browsing plugins. It does not name an install line for this file. - The code-improver README describes the loop and does not contain an install command. Codex marketplace lines in the repository README also add the marketplace rather than this skill. ### Before you start - Claude Code with dynamic-workflow support, as the plugin README states - The plugin-dev skill-reviewer from the claude-plugins-official marketplace, which this review did not install - A skill directory or a unique skill name; several matches require the user to choose ### Compatibility Claude Code ### Local skill text; the loop edits a working tree and does not commit only if an operator runs it - Read the skill text - Edit the working tree only if the operator runs the workflow - Do not treat an improvised inline loop as the workflow ### Cost model CC-BY-SA-4.0; no marketplace install and no workflow run. Share-alike applies to a redistributed adaptation. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill improver SKILL.md ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/skill-improver/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/skills/skill-improver/SKILL.md Supports: Stop rules for a missing workflow or reviewer, no commit, and a capped result is not success - [code-improver README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/code-improver/README.md Supports: Claude Code is required for the loop, and a non-repository target is initialized loudly - [Repository README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: Marketplace install line and the CC-BY-SA-4.0 statement - [Repository LICENSE ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: Attribution-ShareAlike 4.0 International Public License KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Code improver ↗ Pins the generic review loop that will not choose a reviewer, will not start on an unconfirmed scope, and will not commit.](/skills/trailofbits-code-improver/)[### PR improver ↗ Pins the branch loop that refuses the base branch, stops on an empty diff, will not replace a missing reviewer, and does not commit.](/skills/trailofbits-pr-improver/)[### Django performance review ↗ Review Django code and report only performance issues the reviewer traced. Zero findings is an allowed result.](/skills/getsentry-django-perf-review/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)