Plugin

Second Opinion

Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits.

Type: Plugin
Repository: trailofbits/skills
GitHub stars: 7.3k
License: CC-BY-SA-4.0
Repo last updated: Sep 25, 2026
Source file: plugins/second-opinion/.claude-plugin/plugin.json
Version: 1.8.3
Author: Dan Guido

What Second Opinion is

Second Opinion is a plugin published in the trailofbits/skills repository on GitHub, which has about 7.3k stars. The repository describes itself as: “Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows”

A plugin is a package that bundles skills, slash commands, subagents, hooks, and MCP connectors so they install together. Plugins are plain files with a manifest at .claude-plugin/plugin.json, and they work in both Claude Code and Claude Cowork.

Installing Second Opinion adds everything it ships in one step. Connectors inside a plugin still need to be connected separately, and hooks and subagents only run in Cowork and Claude Code, not in regular chat.

How to install Second Opinion

Claude Code

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills
Install the plugin: claude plugin install second-opinion@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json.
Restart the session if the new skills or commands don't appear straight away.

Claude Cowork

Open Customize → Plugins and choose Add marketplace.
Enter trailofbits/skills (the owner/repo shorthand works for GitHub).
Find Second Opinion in the list, click Install, then connect any connectors it needs from its Connectors tab.

New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.

Inside the source file

An excerpt from plugins/second-opinion/.claude-plugin/plugin.json, shared under the repository's CC-BY-SA-4.0 license. Read the full file on GitHub.

Get an independent review of uncommitted changes, a branch diff, or a commit using OpenAI Codex or Google Antigravity. The second-opinion skill can also use Gemini CLI when the selected account supports it.

Setup

Install and authenticate the CLI you intend to use:

Antigravity is the default Google path. If Gemini CLI returns UNSUPPORTED_CLIENT with an Antigravity migration message, that account cannot use the Gemini CLI path. Review extensions are not required.

Install the plugin in Claude Code:

/plugin marketplace add trailofbits/skills
/plugin install second-opinion@trailofbits

Usage

Invoke the second-opinion skill with the provider and scope:

/second-opinion:second-opinion use Codex to review uncommitted changes for bugs
/second-opinion:second-opinion compare Codex and Antigravity against origin/main
/second-opinion:second-opinion use Gemini CLI to review commit abc1234 for security issues

The skill uses choices already given and asks for missing provider or scope details. General review is the default focus. Applicable project instructions are included unless you exclude them.

Uncommitted reviews include staged, unstaged, and untracked changes. When you select both providers, each receives the same captured patch. Results identify the provider, model, findings, and any gaps in coverage.

Execution

Codex runs through codex exec with a read-only sandbox and structured JSON findings. Antigravity runs in print mode and returns prose. Gemini CLI uses a headless prompt for supported accounts.

The skill reports findings without applying fixes or publishing a review. Authentication errors, denied inspection, and missing output are reported as incomplete reviews.

Upgrading an installation with a failed Codex MCP server

Version 1.8.1 removes the plugin's automatic Codex MCP registration. Codex CLI 0.154.0 dropped the server entry point, as recorded in the OpenAI changelog. External reviews use the CLI directly and do not require an MCP connection.

If Claude Code reports CONNECTION_CLOSED for the plugin's Codex server, refresh the marketplace and update the installed plugin:

claude plugin marketplace update trailofbits
claude plugin update second-opinion@trailofbits

Restart Claude Code after updating so it drops the old server registration. The separate codex and codex-reply MCP tools are no longer part of the plugin.

Before you install

Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
Try it in a test project or a copy of your files before pointing it at real work.
Pin the version you tested, and review changes before updating.
Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.

FAQ

What is Second Opinion?

Second Opinion is a plugin for Claude Code and Claude Cowork from the trailofbits/skills repository on GitHub. Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits.

How do I install Second Opinion in Claude Code?

Add the repository as a plugin marketplace: claude plugin marketplace add trailofbits/skills Install the plugin: claude plugin install second-opinion@<marketplace-name>, using the marketplace name from the repository's .claude-plugin/marketplace.json. Restart the session if the new skills or commands don't appear straight away.

Can I use Second Opinion in Claude Cowork?

Open Customize → Plugins and choose Add marketplace. Enter trailofbits/skills (the owner/repo shorthand works for GitHub). Find Second Opinion in the list, click Install, then connect any connectors it needs from its Connectors tab.

Is Second Opinion safe to install?

It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.

Similar resources

Browse all skills, subagents, and plugins →

Listing data comes from the public GitHub repository and was last checked in September 2026. Excerpts are © their authors and shared under CC-BY-SA-4.0. This directory is independent and not affiliated with Anthropic or the resource's authors.