Skip to content
Security
Skill

/second-opinion

Runs external LLM code reviews (OpenAI Codex or Google Antigravity CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, antigravity review, or mentions /second-opinion.

From plugin
trailofbits-skills
7.1k81 skills30 agents8 commands2 MCP
Install
$ npx -y skills add trailofbits/skills --skill second-opinion --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

  • Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
  • You can call itInvoke it directly when you want it.
  • Slash command/second-opinion

Context preview

The summary Claude sees to decide when to auto-load this skill.

Runs external LLM code reviews (OpenAI Codex or Google Antigravity CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, antigravity review, or mentions /second-opinion.

SKILL.md

second-opinion.SKILL.md
name: second-opinion
description: "Runs external LLM code reviews (OpenAI Codex or Google Antigravity CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, antigravity review, or mentions /second-opinion."
allowed-tools: Bash Read Glob Grep AskUserQuestion

Second Opinion

Shell out to external LLM CLIs for an independent code review powered by a separate model. Supports OpenAI Codex CLI (`codex`) and Google Antigravity CLI (`agy`).

When to Use

  • Getting a second opinion on code changes from a different model
  • Reviewing branch diffs before opening a PR
  • Checking uncommitted work for issues before committing
  • Running a focused review (security, performance, error handling)
  • Comparing review output from multiple models

When NOT to Use

  • Neither Codex CLI nor Antigravity CLI is installed
  • No API key or subscription configured for either tool
  • Reviewing non-code files (documentation, config)
  • You want Claude's own review (just ask Claude directly)

Gemini CLI Is End-of-Life

As of 2026-06-18, `gemini` (Gemini CLI) stopped serving Google AI Pro, Ultra, and free-tier individual accounts. Those accounts now get `UNSUPPORTED_CLIENT` on every request, pointing at <https://antigravity.google>. The replacement is **Antigravity CLI**, binary `agy`.

Default to `agy`. Only fall back to `gemini` when the user has a Gemini Code Assist Standard/Enterprise license or a paid Gemini API key (`GEMINI_API_KEY`) — those still work. See [references/gemini-invocation.md](references/gemini-invocation.md) for that legacy path.

Quick Reference

# Codex (headless exec with structured JSON output)
codex exec -c model='"gpt-5.6-sol"' -c model_reasoning_effort='"xhigh"' \
  --sandbox read-only --ephemeral \
  --output-schema codex-review-schema.json \
  -o "$output_file" - < "$prompt_file"

# Antigravity (headless print mode — prompt must be an ARGUMENT, not stdin)
git diff HEAD > /tmp/review-diff.txt
agy --model gemini-3.1-pro-high --output-format text \
  --disable-slash-commands -p="$(cat /tmp/review-prompt.txt)"

Invocation

1. Gather context interactively

Use `AskUserQuestion` to collect review parameters in one shot. Adapt the questions based on what the user already provided in their invocation (skip questions they already answered).

Combine all applicable questions into a single `AskUserQuestion` call (max 4 questions).

**Question 1 — Tool** (skip if user already specified):

header: "Review tool"
question: "Which tool should run the review?"
options:
  - "Both Codex and Antigravity (Recommended)" → run both in parallel
  - "Codex only"                               → codex exec
  - "Antigravity only"                         → agy print mode

If the user says "gemini", treat it as Antigravity unless they explicitly have a paid Code Assist / API-key setup.

**Question 2 — Scope** (skip if user already specified):

header: "Review scope"
question: "What should be reviewed?"
options:
  - "Uncommitted changes" → git diff HEAD + untracked files
  - "Branch diff vs main" → git diff <branch>...HEAD (auto-detect default branch)
  - "Specific commit"     → git diff <sha>~1..<sha> (follow up for SHA)

**Question 3 — Project context** (skip if neither CLAUDE.md nor AGENTS.md exists):

Check for CLAUDE.md first, then AGENTS.md in the repo root. Only show this question if at least one exists.

header: "Project context"
question: "Include project conventions file so the review
  checks against your standards?"
options:
  - "Yes, include it"
  - "No, standard review"

**Question 4 — Review focus** (always ask):

header: "Review focus"
question: "Any specific focus areas for the review?"
options:
  - "General review"    → no custom prompt
  - "Security & auth"   → security-focused prompt
  - "Performance"       → performance-focused prompt
  - "Error handling"    → error handling-focused prompt

2. Run the tool directly

Do not pre-check tool availability. Run the selected tool immediately. If the command fails with "command not found" or an extension is missing, report the install command from the Error Handling table below and skip that tool (if "Both" was selected, run only the available one).

`agy` installs to `~/.local/bin`, which is not always on PATH. Prefix the call with `export PATH="$HOME/.local/bin:$PATH"` before concluding it is missing.

Diff Preview

After collecting answers, show the diff stats:

# For uncommitted (tracked + untracked):
git diff --stat HEAD
git ls-files --others --exclude-standard

# For branch diff:
git diff --stat <branch>...HEAD

# For specific commit:
git diff --stat <sha>~1..<sha>

If the diff is empty, stop and tell the user.

If the diff is very large (>2000 lines changed), warn the user and ask whether to proceed or narrow the scope.

Auto-detect Default Branch

For branch diff scope, detect the default branch name:

git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null \
  | sed 's@^refs/remotes/origin/@@' || echo main

Codex Invocation

See [references/codex-invocation.md](references/codex-invocation.md) for full details on command syntax, prompt assembly, and the structured output schema.

Summary:

  • Uses `codex exec` (not `codex exec review`) for headless operation.

`codex exec review` has native `--uncommitted` / `--base` / `--commit` scope flags, but they are mutually exclusive with a custom `[PROMPT]`, so it cannot carry project context or focus instructions. Keep the manual prompt-assembly approach.

  • Model: `gpt-5.6-sol`, reasoning: `xhigh`
  • Uses OpenAI's published code review prompt (fine-tuned into the model)
  • Diff is generated manually and piped via stdin with the prompt
  • `--output-schema` produces structured JSON findings
  • `-o` captures only the final message (no thinking/exec noise)
  • All three scopes (uncommitted, branch, commit) support pro
Read more
Ships withtrailofbits-skills

A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.

Get the whole plugin

Other skills on trailofbits-skills.