Automate Code Review-and-Fix Loops with code-improver

Where this fits

You've just finished a new module and want it to pass your security review before merging. Instead of manually running a reviewer, applying fixes, and re-reviewing until clean, you ask your agent to "improve this code until review passes" and specify which reviewer to use. The code-improver skill automates that loop: it runs the reviewer, collects findings, triggers a fixer, re-runs, and keeps going until the reviewer reports zero critical/major issues—or stops after a configurable number of rounds.

Why agents benefit

• Autonomous multi-round iteration: No need to babysit the process; the agent loops between reviewer and fixer without human prompting.
• Cross-round findings ledger: Problems found in earlier rounds inform later fixes, so recurring patterns get addressed systematically.
• Convergence guards: If fixes stop reducing findings, the loop escalates instead of spinning forever.
• Mechanical scope control: You define globs (e.g., src/**/*.py) and the agent won't wander outside them.
• Reuse any reviewer: Plug in any installed skill or agent—security, style, or architectural—as the gatekeeper.

Practical scenarios

Hardening a plugin before release

Run /code-improver:improve ./my-plugin --reviewer security-reviewer --scope ""./my-plugin/**" to let a security-focused agent find and fix injection or input-validation issues automatically.

Iterating on a module with a style-conscious reviewer

Use a code-quality skill as the reviewer to enforce linting rules and refactorings across a directory, catching everything from unused imports to long functions.

Cleaning up a legacy directory

Point the loop at a folder that hasn't been touched in months. The reviewer flags dead code and deprecated APIs; the fixer cleans them up while you watch the ledger shrink each round.

Add it to your agent workflow

Install with:

npx skills add trailofbits/skills --skill code-improver

Then invoke the skill on any target:

/code-improver:improve ./src --reviewer my-code-reviewer --scope "*.js" --max-rounds 5

The skill relays the target, reviewer, and scope to the workflow, which handles the rest—including removing its own temporary files when done.

Compare before adopting

Weigh this against manual review-and-fix cycles, or other tools like skill-improver (for skills) and pr-improver (for branches). Also check how often the repo is updated and whether the reviewer you plan to use is reliable. The skill's effectiveness depends on the quality of the underlying reviewer.

Why it is worth tracking

With 6,860 stars and maintenance from Trail of Bits, this skill shows strong community momentum. It's a practical building block for any agent that needs to autonomously improve code, and it pairs well with other skills in the same ecosystem. For developers invested in agent-driven development, it's worth evaluating early to see if its convergence and scope guards match your workflow. Learn more about how it fits into the broader skill landscape at OpenAgentSkill.