Claude Code skill pairs AI models for adversarial code review

The skill works by having Claude spawn a second model—GPT-5.6 Sol—in a live split pane using herdr, an agent multiplexer. Claude writes the diff (or plan) plus the stated intent to a prompt file under /tmp/adversarial-review/, then waits for the reviewer to finish by monitoring herdr's idle/working/blocked status. Once the review completes, Claude interrogates every finding against the actual code and reports each one as Confirmed, Disputed, or Unverified. The reviewer is instructed to be adversarial and will sometimes overstate or manufacture problems, so this verification step is essential; as the documentation notes, "nothing the reviewer found holds up" is a valid outcome.

The setup involves five sequential steps. First, herdr is installed via curl and the user runs terminal sessions inside it. Second, CLIProxyAPI is installed (via a binary download or Docker) and configured at ~/.config/cli-proxy-api/config.yml with a shared API key; the user then logs in with an OpenAI/Codex account and starts the server on http://localhost:8317. Third, agent-safehouse is installed via Homebrew and a safe wrapper is added to ~/.zshrc to enable macOS kernel-level sandboxing, with /tmp granted explicitly because that's where the handoff files live. Fourth, a safecodex shell function is defined that sets environment variables pointing to the local proxy and GPT-5.6 Sol, including flags for effort level and concurrency. Fifth, the skill itself is installed either via Claude Code's plugin marketplace (`/plugin marketplace add overflowy/herdr-claude-gpt-adversarial-review-skill` and `/plugin install adversarial-review@herdr-claude-gpt-adversarial-review-skill`) or by copying the SKILL.md file manually.

In use, the user opens a Claude Code session running inside a herdr pane and asks in natural language—"poke holes in this diff", "red-team this plan", or "get a second opinion before I ship". Claude states the intent, writes the review prompt, splits a herdr pane, and launches safecodex to run the reviewer with --dangerously-skip-permissions (the sandbox confinement replaces the permission gate). The reviewer's TUI runs live in the split pane, then Claude verifies the findings and reports verdicts. The smoke test includes checking that the proxy is up and accepts the API key, and that safecodex works end to end. Common failure modes include the proxy not running on 8317, expired Codex OAuth tokens, the safecodex function not being in interactive shell config (it must live in ~/.zshrc), and sandbox denials if legitimate paths are needed outside the project directory. The skill is released under MIT license.

The skill addresses a common pain point in code review: single reviewers (whether human or AI) can miss issues or overfit to a single perspective. By pairing Claude with GPT-5.6 Sol and routing the second model through a local OpenAI/Codex login via CLIProxyAPI, the creator enables a heterogeneous review without leaving the Claude Code interface. The adversarial framing is deliberate—the reviewer is instructed to find holes—but that same bias becomes a liability if left unchecked, so the architecture includes a verification loop where Claude re-checks each claim against the code itself. The sandbox isolation via agent-safehouse prevents the reviewer from leaking credentials or accessing unrelated files, addressing a natural security concern when spawning a second AI agent.

The setup is deliberately modular: herdr handles the multiplexing and pane lifecycle, CLIProxyAPI bridges the model provider mismatch, agent-safehouse enforces confinement, and a shell function wires the pieces together. This layering means the skill remains decoupled from any single tool's internals, though it does assume the user runs Claude Code inside herdr panes.

No comments yet. Be the first to share your thoughts!