npx skills add ...
npx skills add trailofbits/skills --skill second-opinion
Runs external LLM code reviews (OpenAI Codex or Google Antigravity CLI) on uncommitted changes, branch diffs, or specific commits. Use when the user asks for a second opinion, external review, codex review, gemini review, antigravity review, or mentions /second-opinion.
npx skills add trailofbits/skills --skill second-opinion
Shell out to external LLM CLIs for an independent code review powered by
a separate model. Supports OpenAI Codex CLI (codex) and Google
Antigravity CLI (agy).
As of 2026-06-18, gemini (Gemini CLI) stopped serving Google AI Pro,
Ultra, and free-tier individual accounts. Those accounts now get
UNSUPPORTED_CLIENT on every request, pointing at
https://antigravity.google. The replacement is Antigravity CLI,
binary agy.
Default to agy. Only fall back to gemini when the user has a Gemini
Code Assist Standard/Enterprise license or a paid Gemini API key
(GEMINI_API_KEY) — those still work. See
references/gemini-invocation.md for
that legacy path.
Use AskUserQuestion to collect review parameters in one shot.
Adapt the questions based on what the user already provided
in their invocation (skip questions they already answered).
Combine all applicable questions into a single AskUserQuestion
call (max 4 questions).
Question 1 — Tool (skip if user already specified):
If the user says "gemini", treat it as Antigravity unless they explicitly have a paid Code Assist / API-key setup.
Question 2 — Scope (skip if user already specified):
Question 3 — Project context (skip if neither CLAUDE.md nor AGENTS.md exists):
Check for CLAUDE.md first, then AGENTS.md in the repo root. Only show this question if at least one exists.
Question 4 — Review focus (always ask):
Do not pre-check tool availability. Run the selected tool immediately. If the command fails with "command not found" or an extension is missing, report the install command from the Error Handling table below and skip that tool (if "Both" was selected, run only the available one).
agy installs to ~/.local/bin, which is not always on PATH.
Prefix the call with export PATH="$HOME/.local/bin:$PATH" before
concluding it is missing.
After collecting answers, show the diff stats:
If the diff is empty, stop and tell the user.
If the diff is very large (>2000 lines changed), warn the user and ask whether to proceed or narrow the scope.
For branch diff scope, detect the default branch name:
See references/codex-invocation.md for full details on command syntax, prompt assembly, and the structured output schema.
Summary:
codex exec (not codex exec review) for headless operation.
codex exec review has native --uncommitted / --base /
--commit scope flags, but they are mutually exclusive with a
custom [PROMPT], so it cannot carry project context or focus
instructions. Keep the manual prompt-assembly approach.gpt-5.6-sol, reasoning: xhigh--output-schema produces structured JSON findings-o captures only the final message (no thinking/exec noise)gpt-5.6, then gpt-5.4, on auth errorstimeout: 600000 on the Bash callSee references/antigravity-invocation.md for full details on flags, scope mapping, and model selection.
Summary:
gemini-3.1-pro-high (effort is baked into the model slug)agy
print mode does not read prompts from stdin unless
--input-format stream-json is used. Assemble the prompt into a
file, then pass -p="$(cat "$prompt_file")".-p=<value> with an equals sign. Bare -p swallows the
next flag as its prompt value and silently discards the real one.--disable-slash-commands so a line in the untrusted diff cannot
be expanded as a slash command--mode plan. It intermittently returns a "plan artifact
/ click Proceed" stub instead of the review. Omit --mode entirely--dangerously-skip-permissions; it is unnecessary for
a text-only diff review and will be blocked in restricted environments--output-format text. --json-schema is advisory, not
enforced: it emits schema-shaped JSON nested inside a response
string, duplicates the payload, and ran ~3x slower in testingtimeout: 600000 on the Bash callScope mapping for git diff (Antigravity has no built-in scope flags):
| Scope | Diff command |
|---|---|
| Uncommitted | git diff HEAD + untracked (see codex-invocation.md) |
| Branch diff | git diff <branch>...HEAD |
| Specific commit | git diff <sha>~1..<sha> |
When the user picks "Both" (the default):
Summarize where the two reviews agree and differ.
| Error | Action |
|---|---|
codex: command not found | Tell user: npm i -g @openai/codex |
agy: command not found | Retry with export PATH="$HOME/.local/bin:$PATH". Still missing → tell user to install Antigravity from https://antigravity.google |
agy error: -p took "--model" as its prompt | Use -p=<value> form and move other flags before it |
agy error: empty prompt | The prompt was piped on stdin. Pass it as an argument instead |
gemini error: UNSUPPORTED_CLIENT / "migrate to the Antigravity suite" | Gemini CLI is EOL for individual tiers. Switch to agy |
| Model auth error (Codex) | Retry with gpt-5.6, then gpt-5.4 |
| Empty diff | Tell user there are no changes to review |
| Timeout | Inform user and suggest narrowing the diff scope |
| Tool partially unavailable | Run only the available tool, note the skip |
Both tools (default):
Codex only with inline args:
Antigravity only:
Large diff warning:
header: "Review tool"
question: "Which tool should run the review?"
options:
- "Both Codex and Antigravity (Recommended)" → run both in parallel
- "Codex only" → codex exec
- "Antigravity only" → agy print modeheader: "Review scope"
question: "What should be reviewed?"
options:
- "Uncommitted changes" → git diff HEAD + untracked files
- "Branch diff vs main" → git diff <branch>...HEAD (auto-detect default branch)
- "Specific commit" → git diff <sha>~1..<sha> (follow up for SHA)header: "Project context"
question: "Include project conventions file so the review
checks against your standards?"
options:
- "Yes, include it"
- "No, standard review"header: "Review focus"
question: "Any specific focus areas for the review?"
options:
- "General review" → no custom prompt
- "Security & auth" → security-focused prompt
- "Performance" → performance-focused prompt
- "Error handling" → error handling-focused prompt# For uncommitted (tracked + untracked):
git diff --stat HEAD
git ls-files --others --exclude-standard
# For branch diff:
git diff --stat <branch>...HEAD
# For specific commit:
git diff --stat <sha>~1..<sha>git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null \
| sed 's@^refs/remotes/origin/@@' || echo main## Codex Review (gpt-5.6-sol)
<codex output>
## Antigravity Review (gemini-3.1-pro-high)
<agy output>User: /second-opinion
Claude: [asks 4 questions: tool, scope, context, focus]
User: picks "Both", "Branch diff", "Yes include CLAUDE.md", "Security"
Claude: [detects default branch = main]
Claude: [shows diff --stat: 6 files, +103 -15]
Claude: [assembles prompt with review instructions + CLAUDE.md + security focus + diff]
Claude: [runs codex exec and agy in parallel]
Claude: [reads codex output file, parses structured findings]
Claude: [presents both reviews, highlights agreements/differences]User: /second-opinion check uncommitted changes for bugs
Claude: [scope known: uncommitted, focus known: custom]
Claude: [asks 2 questions: tool, project context]
User: picks "Codex only", "No context"
Claude: [shows diff --stat: 3 files, +45 -10]
Claude: [writes prompt file with review instructions + diff]
Claude: [runs codex exec, reads structured JSON output]
Claude: [presents findings by priority with file:line refs]User: /second-opinion
Claude: [asks 4 questions]
User: picks "Antigravity only", "Uncommitted", "No", "General"
Claude: [shows diff --stat: 2 files, +20 -5]
Claude: [writes prompt file, runs agy --model gemini-3.1-pro-high -p="$(cat prompt.txt)"]
Claude: [presents review]User: /second-opinion
Claude: [asks questions] → user picks "Both", "Uncommitted", "General"
Claude: [shows diff --stat: 45 files, +3200 -890]
Claude: "Large diff (3200+ lines). Proceed, or narrow the scope?"
User: "proceed"
Claude: [runs both reviews]