Gets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
Run an external CLI review of the user's selected changes. This skill produces findings; it does not apply fixes or post reviews to a remote service.
Use the provider, scope, model, and focus already supplied by the user. Ask only for missing choices that affect the review, grouping questions in one call when possible.
For an unspecified Google CLI, prefer Antigravity (agy). An explicit
Gemini CLI request uses the Gemini reference below. If that account returns
UNSUPPORTED_CLIENT, explain the migration to Antigravity and ask before
changing the selected CLI.
A missing executable or account setup is a failed review attempt. Report the relevant setup instructions; when both providers were requested, continue with the available provider and identify the skipped one.
Read review-input.md for the shared prompt and diff recipes. Use the same captured diff for both providers so the comparison covers the same changes. Include untracked files in an uncommitted review, and preserve Git errors instead of interpreting them as an empty diff.
Show the selected scope and a brief change summary. If there are no changes, stop before calling a provider. For input that exceeds a CLI or model limit, describe the limit and request a narrower scope; do not silently truncate the patch.
Create prompt, output, and diagnostic files with mktemp outside the
checkout. Use separate output and diagnostic files for each provider.
Define shell variables in the same Bash invocation that uses them.
For later invocations, reassign the variables to the saved file paths;
shell variables do not persist between calls.
Write repository content as literal data, without shell expansion.
Read only the reference for each selected provider:
| Provider | Invocation and result |
|---|---|
| Codex | codex-invocation.md: codex exec with the review schema |
| Antigravity | antigravity-invocation.md: agy print mode with prose output |
| Gemini CLI | gemini-invocation.md: headless gemini for accounts that still support it |
The Codex path needs no MCP server. Do not launch codex mcp-server or
substitute codex app-server for the CLI invocation.
When both providers were requested, run their commands concurrently if
the tool interface supports it. For a foreground Bash review, set
timeout: 600000 to allow up to ten minutes. Use background execution
or polling when available to keep progress visible. Do not enable
automatic approval of writes to make a review run.
Present findings with the provider and actual model used, severity, file and line, impact, and suggested correction. Keep low-severity defects visible. For Codex, the existing schema uses 0 for informational, 1 for low, 2 for medium, and 3 for high; sort descending.
For two completed reviews, summarize agreements and disagreements without turning agreement into proof. Distinguish the external findings from any assessment you add.
Read the captured output and diagnostics. A nonzero exit, missing output, invalid JSON, permission denial that prevents inspection, or a request to approve a plan is incomplete work, not a clean review. Report the failure and any partial results. Retry only for a diagnosed, recoverable cause; do not cycle through providers after authentication or quota failures.
/second-opinion:second-opinion use Codex to review my uncommitted changes for bugs
selects Codex and includes staged, unstaged, and untracked changes./second-opinion:second-opinion compare Codex and Antigravity on this branch against origin/main
sends the same branch patch to both and compares their findings./second-opinion:second-opinion use Gemini CLI to review commit abc1234 for security issues
preserves the requested CLI and reviews that commit.まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.
日本語の概要は準備中です。原文の説明を表示しています。
Sets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.
日本語の概要は準備中です。原文の説明を表示しています。
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
日本語の概要は準備中です。原文の説明を表示しています。
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).
日本語の概要は準備中です。原文の説明を表示しています。
Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.
日本語の概要は準備中です。原文の説明を表示しています。
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.
日本語の概要は準備中です。原文の説明を表示しています。