Trail of Bits

Second Opinion — Security skill for Claude Code

Security community Advanced

Trail of Bits security skill for second opinion.

How to install Second Opinion

Installs to ~/.claude/skills/second-opinion/

Terminal

git clone --depth 1 https://github.com/trailofbits/skills /tmp/skills \
  && mkdir -p ~/.claude/skills \
  && cp -r /tmp/skills/plugins/second-opinion ~/.claude/skills/second-opinion

Clones the whole repository, because a skill folder can carry scripts and resources beside its SKILL.md.

What Second Opinion does

Run code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits.

Alternatives in Security

FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
Defense In Depth — Implement multi-layered testing and security best practices 98.1k ★
Google Workspace Alert Center — Manage security alerts 21.6k ★

Repository README

This is the README for trailofbits/skills, shared by 13 entries in this directory. It describes the repository, not this entry specifically.

second-opinion

Run code reviews using external LLM CLIs (OpenAI Codex, Google Gemini) on uncommitted changes, branch diffs, or specific commits.

Prerequisites

OpenAI Codex CLI

Codex CLI installed: npm i -g @openai/codex
OpenAI API key or ChatGPT Plus subscription configured for Codex

Google Gemini CLI

Gemini CLI installed: npm i -g @google/gemini-cli
Google account authenticated
Code review extension: gemini extensions install https://github.com/gemini-cli-extensions/code-review
Security extension: gemini extensions install https://github.com/gemini-cli-extensions/security

Installation

/plugin marketplace add trailofbits/skills
/plugin install second-opinion

Usage

/second-opinion

The command will prompt for:

Review tool — Codex, Gemini, or both (default)
Review scope — uncommitted changes, branch diff, or specific commit
Project context — optionally include CLAUDE.md/AGENTS.md for project-aware review
Review focus — general, security, performance, or error handling

Quick invocation

/second-opinion check the uncommitted changes for security issues

Inline arguments pre-fill the scope and focus, skipping redundant questions.

How It Works

Shells out to `codex review` and/or `gemini` CLI with high-capability model configurations. When both tools are selected (the default), runs Codex first then Gemini, presenting results side by side for comparison.

Codex MCP Tools

This plugin bundles Codex CLI's built-in MCP server (`codex mcp-server`), which auto-starts when the plugin is installed and provides two MCP tools:

codex — start a new Codex session with a prompt, model, sandbox, and approval policy settings
codex-reply — continue an existing session by thread ID for multi-turn conversations

...