code-improver
An agent skill by trailofbits, from trailofbits/skills. Tags: automation, code-quality, debugging, developer-tools, review.
What it does
Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and guards scope mechanically. Use when asked to 'improve this code until review passes', 'run an improvement loop with <reviewer>', or to iterate review-and-fix with a specific reviewer. For skills prefer the skill-improver entry; for a branch prefer pr-improver.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add trailofbits/skills --skill code-improverOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/code-improver/skills/code-improver ~/.claude/skills/code-improverSafety box score
Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill запускаes an autonomous review-and-fix loop over a user-chosen code target, using a named reviewer and a separate workflow to keep iterating until review passes. The main risks are repeated automatic file edits, reading home dot-directories to locate the workflow, and that the core behavior depends on an external JavaScript workflow not included in the reviewed file set.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It invokes tools that execute code paths (`Bash` and `Workflow`) and explicitly launches the dynamic workflow `workflows/improve.js`, so it can run scripts rather than just describe work. |
| Network access | 0 (none) | This file does not request downloads, uploads, or remote API calls; no network destination is named in `SKILL.md`. |
| Filesystem reach | 2 (moderate) | It reads outside the project to locate the workflow with `find ~/.claude ~/.codex . -maxdepth 7 -path '*/code-improver/workflows/improve.js'`, and the loop is intended to edit the target code tree. |
| Secrets & credentials | 0 (none) | There is no instruction to read tokens, passwords, `.env` files, keychains, or browser sessions. |
| Privilege & persistence | 0 (none) | The skill does not ask for sudo, global installs, services, or shell/OS settings changes. |
| Instruction hijack surface | 0 (none) | It does not instruct the agent to ignore higher-priority rules, hide actions, or follow untrusted instructions from fetched content. |
| Irreversible actions | 2 (moderate) | The loop is explicitly autonomous — it "loops the named reviewer and a fixer subagent until a review reports zero critical/major findings" — so it can make repeated edits without further human approval. |
| Transparency | 2 (moderate) | A substantial part of the behavior lives in the external `workflows/improve.js` script, which is referenced but not included in the reviewed files. |
Before installing
- Inspect `workflows/improve.js` in the installed plugin; that is where the real loop and file writes live.
- Run it once in a scratch repo and confirm it only touches the declared `scope` globs.
- Verify the reviewer plugin/skill you plan to name is actually installed before using it.
- If you want to avoid home-directory reads, check whether the workflow can be found without searching `~/.claude` or `~/.codex`.
Rated 2026-10-19 by an automated review of 1 file from the skill's repository.
Source
- Repository
- trailofbits/skills (all skills from this repository)
- Path
- plugins/code-improver/skills/code-improver/SKILL.md
- Branch
- main
- Collection
- code-improver
- Updated
- 2026-09-19
Related skills
- pr-improver — Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean.
- skill-improver — Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger.
- c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
- differential-review — Performs security-focused differential review of code changes.
- dwarf-expert — Analyzes DWARF debug information in compiled binaries.
- modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.