Agent安装
- 作者仓库星标 5,723
- 叉子 499
- 作者更新于 2026年6月15日 16:05
- 作者仓库 skills
- 领域
- 工程开发
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @trailofbits · 未声明 license
- Token 消耗评级
- 中等消耗
- 接入复杂程度
- 需简单配置
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- 未声明(默认跨平台)
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- Shell 执行
- 网络行为
- 仅限本地
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: skill-improver
description: Iteratively reviews and fixes Claude Code skill quality issues until they meet standards. Runs a…
category: 工程开发
runtime: 无特殊运行时
---
# skill-improver 输出预览
## PART A: 任务判断
- 适用问题:代码实现、重构、调试或代码审查。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Prerequisites / Core Loop / When to Use”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于代码实现、重构、调试或代码审查,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Prerequisites / Core Loop / When to Use”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、执行终端命令、主要在本地完成、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件、执行终端命令;主要在本地完成;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文出现了 `/plugins`、`/skill-reviewer`、`/path` 这类斜杠命令;如果你的 Agent 支持命令触发,优先用命令开场,再补充目标和边界。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件、执行终端命令。
先用一个小任务确认它会围绕“Prerequisites / Core Loop / When to Use”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: skill-improver
description: Iteratively reviews and fixes Claude Code skill quality issues until they meet standards. Runs a…
category: 工程开发
source: trailofbits/skills
---
# skill-improver
## 什么时候使用
- 用于审阅代码、文档或方案并给出可执行反馈 适合处理工程开发场景下的代码实现、调试、重构、测试或代码审查,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤;通常…
- 面向代码实现、重构、调试或代码审查,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Prerequisites / Core Loop / When to Use」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令;主要在本地完成;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "skill-improver" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Prerequisites / Core Loop / When to Use
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、写入/修改文件、执行终端命令 | 主要在本地完成
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} Skill Improvement Methodology
Iteratively improve a Claude Code skill using the skill-reviewer agent until it meets quality standards.
Prerequisites
Requires the plugin-dev plugin which provides the skill-reviewer agent.
Verify it's enabled: run /plugins — plugin-dev should appear in the list. If missing, install from the Trail of Bits plugin repository.
Core Loop
- Review - Call skill-reviewer on the target skill
- Categorize - Parse issues by severity
- Fix - Address critical and major issues
- Evaluate - Check minor issues for validity before fixing
- Repeat - Continue until quality bar is met
When to Use
- Improving a skill with multiple quality issues
- Iterating on a new skill until it meets standards
- Automated fix-review cycles instead of manual editing
- Consistent quality enforcement across skills
When NOT to Use
- One-time review: Use
/skill-reviewerdirectly instead - Quick single fixes: Edit the file directly
- Non-skill files: Only works on SKILL.md files
- Experimental skills: Manual iteration gives more control during exploration
Issue Categorization
Critical Issues (MUST fix immediately)
These block skill loading or cause runtime failures:
- Missing required frontmatter fields (name, description) — Claude cannot index or trigger the skill
- Invalid YAML frontmatter syntax — Parsing fails, skill won't load
- Referenced files that don't exist — Runtime errors when Claude follows links
- Broken file paths — Same as above, leads to tool failures
Major Issues (MUST fix)
These significantly degrade skill effectiveness:
- Weak or vague trigger descriptions — Claude may not recognize when to use the skill
- Wrong writing voice (second person "you" instead of imperative) — Inconsistent with Claude's execution model
- SKILL.md exceeds 500 lines without using references/ — Overloads context, reduces comprehension
- Missing "When to Use" or "When NOT to Use" sections — Required by project quality standards
- Description doesn't specify when to trigger — Skill may never be selected
Minor Issues (Evaluate before fixing)
These are polish items that may or may not improve the skill:
- Subjective style preferences — Reviewer may have different taste than author
- Optional enhancements — May add complexity without proportional value
- "Nice to have" improvements — Consider cost-benefit before implementing
- Formatting suggestions — Often valid but low impact
Minor Issue Evaluation
Before implementing any minor issue fix, evaluate:
- Is this a genuine improvement? - Does it add real value or just satisfy a preference?
- Could this be a false positive? - Is the reviewer misunderstanding context?
- Would this actually help Claude use the skill? - Focus on functional improvements
Only implement minor fixes that are clearly beneficial. Skill-reviewer may produce false positives.
Invoking skill-reviewer
Use the skill-reviewer agent from the plugin-dev plugin. Request a review by asking Claude to:
Review the skill at [SKILL_PATH] using the plugin-dev:skill-reviewer agent. Provide a detailed quality assessment with issues categorized by severity.
Replace [SKILL_PATH] with the absolute path to the skill directory (e.g., /path/to/plugins/my-plugin/skills/my-skill).
Example Fix Cycle
Iteration 1 — skill-reviewer output:
Critical: SKILL.md:1 - Missing required 'name' field in frontmatter
Major: SKILL.md:3 - Description uses second person ("you should use")
Major: Missing "When NOT to Use" section
Minor: Line 45 is verbose
Fixes applied:
- Added name field to frontmatter
- Rewrote description in third person
- Added "When NOT to Use" section
Iteration 2 — run skill-reviewer again to verify fixes:
Minor: Line 45 is verbose
Minor issue evaluation: Line 45 communicates effectively as-is. The verbosity provides useful context. Skip.
All critical/major issues resolved. Output the completion marker:
<skill-improvement-complete>
Note: The marker MUST appear in the output. Statements like "quality bar met" or "looks good" will NOT stop the loop.
Completion Criteria
CRITICAL: The stop hook ONLY checks for the explicit marker below. No other signal will terminate the loop.
Output this marker when done:
<skill-improvement-complete>
When to output the marker:
- skill-reviewer reports "Pass" or no issues found → output marker immediately
- All critical and major issues are fixed AND you've verified the fixes → output marker
- Remaining issues are only minor AND you've evaluated them as false positives or not worth fixing → output marker
When NOT to output the marker:
- Any critical issue remains unfixed
- Any major issue remains unfixed
- You haven't run skill-reviewer to verify your fixes worked
The marker is the ONLY way to complete the loop. Natural language like "looks good" or "quality bar met" will NOT stop the loop.
Rationalizations to Reject
- "I'll just mark it complete and come back later" - Fix issues now
- "This minor issue seems wrong, I'll skip all of them" - Evaluate each one individually
- "The reviewer is being too strict" - The quality bar exists for a reason
- "It's good enough" - If there are major issues, it's not good enough
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核