Skip to main content
affpapa.org
RU EN
skill CX Codex

skill-improver · trailofbits — Claude Code skill: what it does, install

This skill runs repeated review and fix rounds on another skill until critical and major findings are gone.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill skill-improver -a claude-code
Open on GitHub

What skill-improver does

skill-improver resolves the target skill, sends it to the plugin-dev:skill-reviewer subagent, and starts a corrective loop. Each round keeps a findings ledger, while recurring or non-converging issues trigger escalation. Once the review is clean, the workflow removes its own temporary residue.

A mechanical scope guard checks that edits stay within the allowed directory and flags new files. The workflow runs in the background, leaves commits untouched, and can resume after an escalation with the user’s decision. The plugin-dev plugin from the claude-plugins-official marketplace must be installed, or the named reviewer cannot run.

What it helps with

  • fix quality issues in a skill
  • iterate until critical and major findings are cleared
  • resume improvement after an escalation
  • keep automated edits inside the permitted scope

Example prompts for the agent

  • Fix my skill at SKILL_NAME_OR_PATH until the review passes.
  • Improve SKILL_NAME_OR_PATH and use the --max-rounds N limit.
  • Continue the skill improvement loop after the escalation using my decision.

How to install skill-improver

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill skill-improver -a claude-code

2Manually: put the files in place

~/.claude/skills/skill-improver/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/skill-improver/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about skill-improver

How do I install skill-improver in Claude Code?

Run npx skills add trailofbits/skills --skill skill-improver -a claude-code. The skill file will be available at ~/.claude/skills/skill-improver/SKILL.md.

What does skill-improver do?

It connects a reviewer and a fixing subagent into a loop that checks the target skill, applies changes, and reviews it again until critical and major findings reach zero. A cross-round ledger preserves the review history.

What happens when improvement stops converging?

The loop halts with an escalation message and the related finding IDs. After the user makes a decision, the same target can be run again and the existing ledger is loaded.

Similar skills

All skills for Agent setup: memory, context, orchestration →

skill-improver by other authors comes first.

skill-improver Galaxy-Dawn Applies recommendations from skill review plans to Claude Code skill files. Backs up original files and checks YAML syntax. CX Codex +1 397installs setup-matt-pocock-skills Matt Pocock This skill configures a repository for Matt Pocock's engineering skills by setting its issue tracker, triage labels, and domain docs layout. Run it before using the other skills. 1,052,851installs ask-matt Matt Pocock Routes you to the right Matt Pocock skill or flow for the task at hand. Use it when you need a starting point for a feature, prototype, incoming issue, or hard bug. 766,587installs to-tickets Matt Pocock Turns a plan, spec, or conversation into small end-to-end tickets with explicit blockers. Use it to agree on the work breakdown before tickets go to a tracker. 711,230installs writing-plans Jesse Vincent This skill turns requirements for a multi-step task into an implementation plan before code changes begin. It helps when another engineer needs exact files, interfaces, and checks. CX Codex 282,859installs caveman-review JuliusBrussee Turns code review comments into one line per finding: location, problem, fix. Useful when a diff or PR needs a fast pass without the filler. CX Codex +1 411,800installs caveman-compress JuliusBrussee Compresses CLAUDE.md, todo lists, and other prose files into a shorter format while retaining a readable backup. CX Codex +1 411,500installs

From the same set77

burpsuite-project-parser Explores and queries Burp Suite project files from the command line. It extracts proxy history, scanner findings, and HTTP traffic without opening the desktop app. CX Codex +1 5,100installs yara-rule-authoring Authors and reviews YARA-X detection rules for malware hunting, flagging strings that produce weak atoms and conditions that will fire on clean files. CX Codex +1 5,100installs ruzzy This skill installs and runs Ruzzy, a coverage-guided Ruby fuzzer built on libFuzzer. Reach for it when a gem needs crash hunting or a native extension needs a memory-safety check. CX Codex +1 5,100installs wycheproof Validates cryptographic implementations using Project Wycheproof test vectors. It helps your agent spot known vulnerabilities and edge cases across AES, RSA, and ECDSA. CX Codex +1 5,200installs let-fate-decide This skill uses a Tarot spread to suggest a direction when a request leaves several reasonable options open. It suits casual handoffs where the agent is asked to choose. CX Codex +1 4,700installs zeroize-audit Finds passwords, keys and tokens left in memory across C, C++ and Rust, and checks whether the compiler threw their wiping away. CX Codex +1 4,700installs diagramming-code Generates Mermaid diagrams from code graphs using Trailmark. Useful for visualizing call paths, module dependencies, and data flows. CX Codex +1 4,200installs dimensional-analysis Audits numeric code for unit confusion and decimal-scale errors, then adds dimensional comments. Use it when formulas or conversions need a unit-level review. CX Codex +1 4,200installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor