Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

second-opinion — Claude Code skill: what it does, how to install

Runs external CLI code reviews via Codex or Antigravity. It inspects dirty working trees, branch diffs, and specific commits without editing files.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add trailofbits/skills --skill second-opinion -a claude-code
Open on GitHub

What second-opinion does

The skill delegates code review to external command-line tools: Codex, Antigravity (agy), or headless Gemini CLI. It captures a Git patch including untracked files and sends the identical diff to the chosen engines. Output arrives as a list of findings with severity levels, file paths, line numbers, and suggested adjustments. The skill only reports issues and never applies edits or submits remote reviews.

Working account credentials and local CLI binaries are strictly required before running a check. You do not need to start a Codex MCP server because execution relies directly on codex exec. When diffs exceed token thresholds, the review halts with an explicit error rather than silently cutting the patch.

What it helps with

  • compare review findings between Codex and Antigravity
  • spot defects across uncommitted code and untracked files
  • review security issues on a single Git commit

Example prompts for the agent

  • /second-opinion:second-opinion run Codex review on dirty files to spot bugs
  • /second-opinion:second-opinion compare Codex against Antigravity on this branch versus origin/main
  • /second-opinion:second-opinion check commit abc1234 for security flaws using Gemini CLI

How to install second-opinion

1Skills CLI (Vercel)

npx skills add trailofbits/skills --skill second-opinion -a claude-code

2Manually: put the files in place

~/.claude/skills/second-opinion/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/second-opinion/

From the same set35

The whole set →
semgrep trailofbits Runs a Semgrep static security audit on your codebase. It presents a plan for user confirmation and merges all findings into SARIF. Claude Code CX Codex Cursor +1 9,500installs differential-review trailofbits Reviews code changes for security issues using Git history and test coverage. Use it for commits, diffs, and pull requests that need a written review report. Claude Code CX Codex Cursor +1 8,800installs modern-python trailofbits Configures Python projects with a modern tooling stack: uv for dependency management, ruff for linting and formatting, ty for type checking. Use when starting new projects, writing scripts, or migrating from legacy tools. Claude Code CX Codex Cursor +1 8,700installs secure-workflow-guide trailofbits Guides smart contracts through Trail of Bits' 5-step security audit on check-in or before deployment. It runs static analysis, generates visual charts, and prepares fuzzing tests. Claude Code CX Codex Cursor +1 7,400installs sharp-edges trailofbits Audits API designs and configuration schemas for developer footguns. Flags dangerous defaults and fragile interfaces where the easiest path causes security vulnerabilities. Claude Code CX Codex Cursor +1 6,900installs agentic-actions-auditor trailofbits Inspects GitHub Actions workflows for prompt injection risks and insecure AI agent setups. Catches attacker inputs leaking into prompts via event contexts or environment variables. Claude Code CX Codex Cursor +1 6,700installs gh-cli trailofbits A skill that redirects GitHub requests from curl and fetch to authenticated gh CLI for repositories, pull requests, and issues. Use it for private repos and higher API limits. Claude Code CX Codex Cursor +1 6,600installs variant-analysis trailofbits Finds related occurrences of an already identified defect across a repository. Use it after a vulnerability or logic issue turns up and similar code needs checking. Claude Code CX Codex Cursor +1 6,400installs

Similar

typescript-advanced-types sickn33 Teaches the agent generics, conditional and mapped types in TypeScript, and stays honest about where type checking stops. Claude Code CX Codex Cursor +1 1,300installs laravel-best-practices laravel Indexes Laravel backend conventions for models, migrations, queues, and queries. It enforces existing codebase patterns before introducing new abstractions. Claude Code CX Codex Cursor +1 2,100installs visual-edit-precision Adit Jain Skill for targeted UI changes when you show elements on a screenshot or point them out in code. Edits only what you selected, without refactoring the entire component. Claude Code CX Codex Cursor 2,800installs shipping-artifacts phuryn Generates core documentation to make vibe-coded applications reviewable before release. It maps architecture, permission flows, and test coverage for audits. Claude Code CX Codex Cursor +1 1,700installs dart-run-static-analysis dart-lang Runs dart analyze to catch errors and dart fix --apply to resolve mechanical linter issues. Helps verify Dart code quality during development and before commits. Claude Code CX Codex Cursor +1 19,000installs review-and-ship cursor This skill automates code review before shipping: checks for bugs, tests, and intent fit, then commits and opens a PR. Use it to verify your work is ready before merge. Claude Code CX Codex Cursor +1 2,500installs improve-codebase-architecture Matt Pocock This skill scans a codebase for architectural friction, then builds a visual HTML report with refactoring candidates. Use it before a deeper architecture review. Claude Code 1,163,035installs tdd Matt Pocock Guides the red-green TDD loop: ensures tests are written first, keep them at public interfaces, and avoid coupling to implementation details. Claude Code 1,141,062installs

Questions about second-opinion

How to install second-opinion in Claude Code?

Run npx skills add trailofbits/skills --skill second-opinion -a claude-code in your terminal. This saves the skill file to ~/.claude/skills/second-opinion/SKILL.md.

What does second-opinion do?

It gathers Git diffs from your working tree or commit history and invokes external review CLIs like Codex or Antigravity. The tool surfaces severity-ranked issues without applying code fixes or posting online.

Does Codex integration require an MCP server?

No, running codex mcp-server or codex app-server is not needed. The skill invokes codex exec directly using a structured JSON schema.

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor