SKILL·7FF789

code-improver

trailofbits
更新于 4 days ago
6,918
596
6,918
在 GitHub 上查看
general

关于

This skill autonomously runs a review-and-fix improvement loop on any code target using a specified reviewer agent. It maintains a findings ledger across rounds, escalates when fixes stop converging, and mechanically guards scope. Use it when asked to iteratively improve code until a review passes with a particular reviewer.

快速安装

Claude Code

推荐
主要方式
npx skills add trailofbits/skills -a claude-code
插件命令备选方式
/plugin add https://github.com/trailofbits/skills
Git 克隆备选方式
git clone https://github.com/trailofbits/skills.git ~/.claude/skills/code-improver

在 Claude Code 中复制并粘贴此命令以安装该技能

技能文档

Code Improver

Improve any code target by running /code-improver:improve — a dynamic workflow that loops the named reviewer and a fixer subagent until a review reports zero critical/major findings, then strips its own residue. The loop, its ledger, and its guards live in the workflow; this skill collects the three inputs the generic entry requires and relays the outcome.

Starting the loop

The user provided: $ARGUMENTS (if empty, take the details from the conversation).

1. Collect the three required inputs — no guessing

  1. Target: the absolute path to the directory under improvement. Resolve relative paths against the working directory; verify the directory exists.
  2. Reviewer: the installed skill or agent that performs every review. The user must name it — there is no default and no bundled reviewer. Determine the kind:
    • a namespaced agent (e.g. plugin-dev:skill-reviewer) → "kind": "agent"
    • an installed skill (e.g. pr-review-toolkit:review-pr) → "kind": "skill" If the name could be either, check the session's skill listing; if still ambiguous, ask the user. If no reviewer was named, ask — do not pick one.
  3. Scope: repo-relative globs the loop may touch. The generic entry requires it explicitly; if the user did not give one, propose the target directory (<repo-relative-target>/**) and confirm before launching.

2. Resolve the loop script

The loop is the dynamic workflow workflows/improve.js in this plugin. Launch it by path: scriptPath takes a resolved absolute path, and the Workflow tool's name resolves built-in and project workflows, so a marketplace-installed one may not answer to code-improver:improve. Try in order, first hit wins — the home directories come before . so an installed copy beats a checkout of this marketplace:

  1. Bash: ls -d -- "${CLAUDE_PLUGIN_ROOT}/workflows/improve.js"
  2. Bash: ls -d -- "${CODEX_PLUGIN_ROOT}/workflows/improve.js" (if that variable is set instead)
  3. Bash: find ~/.claude ~/.codex . -maxdepth 7 -path '*/code-improver/workflows/improve.js' -print -quit 2>/dev/null

Use the path exactly as printed. Its plugin directory — the path with /workflows/improve.js removed — is pluginRoot. If all three come back empty, try {name: "code-improver:improve"} once; if that is unavailable too, stop and say the loop could not be located. Do not assemble a path by hand and do not improvise the loop.

3. Invoke the workflow

Run it with the Workflow tool, {scriptPath: "<the path from step 2>", args: {...}}:

{
  "target": "<absolute target path>",
  "reviewer": { "kind": "agent|skill", "name": "<namespaced-name>", "notes": "<what the reviewer should know about the target>" },
  "scope": ["<repo-relative-glob>/**"],
  "pluginRoot": "<the plugin directory from step 2>",
  "maxRounds": 5
}
  • maxRounds only if the user asked for a different cap.
  • pluginRoot lets the run find its metrics collector; omit the key only if step 2 fell through to the workflow name — the workflow then searches for itself.
  • finalize ({"version_bump": bool, "narration_strip": bool, "docs_pass": bool}) only to override the defaults: version bump when the target sits inside a plugin, narration strip and docs pass always.
  • decision only on continuation (below).

The workflow runs in the background and needs no babysitting: it reviews, fixes, re-reviews, checks scope after every fix round, and can only complete on a clean review. It never commits; all changes stay in the working tree.

If the Workflow tool is unavailable or denied, stop and say so. Do not improvise the loop inline with direct edits — the ledger, scope guard, and escalation guarantees live in the workflow, and an inline imitation has none of them.

If the result is halted: "reviewer-unavailable", relay it and stop. The named reviewer is not installed in this session; tell the user which plugin provides it and re-run after installing. Do not review the target yourself.

Do not end your turn while the loop is running. The Workflow tool returns a task id immediately; the result comes later. In an interactive session the completion notification re-invokes you — wait for it. In a non-interactive run (scripted, CI, eval) there is no later turn: stopping abandons the loop mid-round, so after launching, poll the task (TaskOutput with the returned task id, or sleep-and-recheck) until it completes, then relay the result. A session that answers "the loop is running, I'll report later" has lost the run.

Relaying the result

The workflow returns a structured result. Report it honestly — the distinctions matter:

  • converged: true — the last action was a review with zero critical/major findings. Report rounds used, remaining minor findings (open_minor_count), and the artifact paths (ledger_path, metrics).
  • capped: true — the fix budget ran out and the FINAL review still found blocking issues. Say plainly: capped, NOT converged, and list open_blocking. Do not present this as success.
  • escalation — the loop detected it was not converging (recurring findings, non-decreasing counts, or a fix relocating a problem). Relay the escalation message and finding ids to the user: this needs a design decision, not more rounds.
  • halted — a guard fired (scope violation, unregistered new files, a dead or unavailable reviewer, or a finalize pass whose own edits failed the check that follows it). Relay the paths in violations/new_untracked_files, the sites in finalize_regressions, and the notes.
  • notes always travel with the result — surface them; they include loud warnings such as "a git repository was initialized".

Continuing after an escalation

The loop stops on escalation by design. When the user decides, start a fresh run with the same target and reviewer plus:

{ "decision": "<the user's ruling, verbatim>" }

The new run reloads the on-disk ledger, so every finding, rejection, and verdict carries over — rounds restart, re-derivation does not.

To stop a running loop, stop the workflow task (TaskStop); the ledger on disk is current to the last round and a re-run resumes from it.

When NOT to use

  • A Claude Code skill: use the skill-improver entry — it wires the right reviewer
  • A branch / pull request: use the pr-improver entry — it derives scope from the diff
  • One-time review: dispatch the reviewer directly; the loop's value is iteration
  • Quick single fixes: edit the file directly

GitHub 仓库

trailofbits/skills
路径: plugins/code-improver/skills/code-improver
0
agent-skills
FAQ

常见问题

什么是 code-improver Skill?

code-improver 是一个 Claude Skill,作者为 trailofbits。Skill 将 Claude 按需加载的说明和资源打包,让 Claude 无需额外提示即可执行与 code-improver 相关的任务。

如何安装 code-improver?

使用本页的安装命令:将 code-improver 作为插件添加到 Claude Code,或将其仓库克隆到 skills 目录,然后重启 Claude 以加载该 Skill。

code-improver 属于哪个分类?

code-improver 属于元分类。

code-improver 可以免费使用吗?

可以。code-improver 已收录在 AIMCP,可免费安装。

相关推荐技能

content-collections

Content Collections 是一个 TypeScript 优先的构建工具,可将本地 Markdown/MDX 文件转换为类型安全的数据集合。它专为构建博客、文档站和内容密集型 Vite+React 应用而设计,提供基于 Zod 的自动模式验证。该工具涵盖从 Vite 插件配置、MDX 编译到生产环境部署的完整工作流。

查看技能
polymarket

这个Claude Skill为开发者提供完整的Polymarket预测市场开发支持,涵盖API调用、交易执行和市场数据分析。关键特性包括实时WebSocket数据流,可监控实时交易、订单和市场动态。开发者可用它构建预测市场应用、实施交易策略并集成实时市场预测功能。

查看技能
creating-opencode-plugins

该Skill帮助开发者创建OpenCode插件,用于接入命令、文件、LSP等25+种事件。它提供了插件结构、事件API规范和JavaScript/TypeScript实现模式,适合需要拦截操作、扩展功能或自定义事件处理的场景。开发者可通过它快速构建响应式模块来增强OpenCode AI助手的能力。

查看技能
sglang

SGLang是一个专为LLM设计的高性能推理框架,特别适用于需要结构化输出的场景。它通过RadixAttention前缀缓存技术,在处理JSON、正则表达式、工具调用等具有重复前缀的复杂工作流时,能实现极速生成。如果你正在构建智能体或多轮对话系统,并追求远超vLLM的推理性能,SGLang是理想选择。

查看技能