Copilot

/copilot — Cross-Model Review via GitHub Models

This skill wraps the GitHub Models API (models.github.ai) to get a cross-model second opinion from GPT-5, GPT-4.1, o3, o4-mini, DeepSeek R1, Grok, and more. It's a free drop-in alternative to /codex for anyone with a GitHub Copilot subscription.

Default model: openai/gpt-4.1 (1M-token context, high-tier rate limits, works with real-world diff sizes). For short consult prompts, override with -m openai/gpt-5 for max reasoning.

Key differences from /codex:

• No sandbox. No tool use. Stateless chat.
• Context is gathered by the wrapper (git diff, status, log) and injected

into the prompt before sending.

• Session continuity not supported (GitHub Models is stateless).
• Rate limited: GitHub Models has per-minute and daily caps. For heavy use

against huge diffs, install the real OpenAI codex CLI.

---

Step 0: Check prerequisites

COPILOT_BIN=$(command -v copilot 2>/dev/null || echo "")
[ -z "$COPILOT_BIN" ] && COPILOT_BIN=~/.claude/skills/copilot/bin/copilot
[ -x "$COPILOT_BIN" ] && echo "READY: $COPILOT_BIN" || echo "NOT_FOUND"

# Token check (env var takes precedence, then file)
if [ -n "${GITHUB_MODELS_TOKEN:-}" ]; then
  echo "TOKEN_OK (env)"
elif [ -s "${GITHUB_MODELS_TOKEN_FILE:-$HOME/.config/claude-copilot/token}" ]; then
  echo "TOKEN_OK (file)"
else
  echo "TOKEN_MISSING"
fi

If NOT_FOUND: Tell the user to run the installer: cd ~/.claude/skills/copilot && ./install.sh — or see the project README.

If TOKEN_MISSING: Tell the user:

> No GitHub Models token found. Create a GitHub Personal Access Token at > https://github.com/settings/tokens/new (classic, no scopes needed), then > either: > > ``bash > # Option A: file > mkdir -p ~/.config/claude-copilot > echo -n 'ghp_yourtoken' > ~/.config/claude-copilot/token > chmod 600 ~/.config/claude-copilot/token > > # Option B: env var (add to ~/.bashrc or ~/.zshrc) > export GITHUB_MODELS_TOKEN=ghp_yourtoken > `` > > GitHub Models is free for Copilot subscribers. Plain GitHub accounts get a > smaller free allowance with per-minute caps.

---

Step 1: Detect mode

Parse the user's input:

1. /copilot review or /copilot review — Review mode (Step 2A)
2. /copilot challenge or /copilot challenge — Challenge mode (Step 2B)
3. /copilot with no arguments:

• Check for a diff: git diff origin/ --stat 2>/dev/null | tail -1
• If a diff exists, use AskUserQuestion to offer Review or Challenge mode
• Otherwise treat as Consult mode and ask for a prompt

1. /copilot — Consult mode (Step 2C) with the remaining text as the prompt

---

Step 2A: Review Mode

Run a code review against the current branch diff.

1. Detect base branch:

git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||'

1. Run the review:

copilot review "${USER_INSTRUCTIONS:-Review for correctness, security, and structural issues. Flag real problems, not style nits.}" --base 

Timeout: 5 minutes. The wrapper gathers the diff itself and injects it into the prompt, so no tool use is required.

1. Capture output. Parse for [P1] markers to determine gate verdict:

• [P1] present → GATE: FAIL
• No [P1] → GATE: PASS

1. Present the output:

COPILOT SAYS (GPT-4.1 review):
════════════════════════════════════════════════════════════

════════════════════════════════════════════════════════════
GATE: PASS                    Tokens: N | Model: gpt-4.1

1. Cross-model comparison: If /review (Claude's review) was already run

earlier in this conversation, compare findings. Overlap, unique to Copilot, unique to Claude, agreement rate.

1. Persist the review result (if gstack is installed):

~/.claude/skills/gstack/bin/gstack-review-log '{"skill":"copilot-review","timestamp":"TIMESTAMP","status":"STATUS","gate":"GATE","findings":N,"findings_fixed":0,"commit":"'"$(git rev-parse --short HEAD)"'"}'

Substitute TIMESTAMP (ISO 8601), STATUS (clean if PASS, issues_found if FAIL), GATE (pass or fail), findings (count of [P1] + [P2] markers).

---

Step 2B: Challenge (Adversarial) Mode

Try to break the code.

1. Construct the adversarial prompt. Default (no focus):

> Review the changes on this branch against the base branch. Your job is to find ways this code will fail in production. Think like an attacker and a chaos engineer. Find edge cases, race conditions, security holes, resource leaks, failure modes, and silent data corruption paths. Be adversarial. Be thorough. No compliments, just the problems.

With focus (e.g. "security"):

> Review the changes on this branch against the base branch. Focus specifically on SECURITY. Find every way an attacker could exploit this code. Think about injection vectors, auth bypasses, privilege escalation, data exposure, and timing attacks. Be adversarial.

1. Run it:

copilot review "" --base 

1. Present output in a CHALLENGE block, same format as Review mode but labeled "adversarial".

---

Step 2C: Consult Mode

Ask anything. Stateless — each consult is independent.

1. Construct the prompt. If the user prompt mentions a plan file, read the plan

content yourself and embed it inline (do NOT pass a file path; the model cannot read files).

1. Run it:

copilot exec ""

1. Present the output:

COPILOT SAYS (GPT-4.1 consult):
════════════════════════════════════════════════════════════

════════════════════════════════════════════════════════════
Tokens: N | Model: gpt-4.1

---

Model selection

Default: openai/gpt-4.1 (1M context, high-tier rate limits, best for real diffs).

Override via flag: /copilot review -m openai/gpt-5 or set env var COPILOT_MODEL=openai/o3 before invocation.

Rate limit reality (GitHub Models free tier):

| Model | Input cap | RPM | Daily cap | |---|---|---|---| | openai/gpt-5, o1, o3, o4-mini | 4000 tokens | low | tight | | openai/gpt-4.1, gpt-4o (high tier) | 8000 tokens | higher | higher | | openai/gpt-4.1-mini, gpt-4o-mini (low tier) | 8000 tokens | highest | highest |

Takeaway: gpt-5 is only useful for tiny prompts (<4k tokens). For actual code review, use gpt-4.1 (default) — it has the best balance of input size and rate limit on the GitHub Models free tier.

Available high-tier models (from the GitHub Models catalog):

• openai/gpt-5, openai/gpt-5-mini, openai/gpt-5-nano
• openai/gpt-4.1, openai/gpt-4.1-mini, openai/gpt-4o
• openai/o1, openai/o3, openai/o3-mini, openai/o4-mini
• deepseek/deepseek-r1, deepseek/deepseek-v3-0324
• xai/grok-3, xai/grok-3-mini
• meta/llama-4-maverick-17b-128e-instruct-fp8
• mistral-ai/codestral-2501

---

Integration with gstack /autoplan (optional)

The copilot binary is a drop-in for codex exec and codex review. If you install the optional codex PATH shim from this skill, gstack's /autoplan picks it up automatically:

command -v codex   # points to the shim, which execs copilot

When the real codex CLI is installed later (via npm install -g @openai/codex), it takes PATH precedence and the shim falls unused. No cleanup needed.

Review log entries are tagged copilot-review so they can be distinguished from real codex-review entries in plan review reports.

---

Important Rules

1. Never modify files. This skill is read-only.
2. Present output verbatim. Do not truncate, summarize, or editorialize

output before showing it.

1. Add synthesis after, not instead of. Any commentary comes after

the full output block.

1. Gate on P1. Any [P1] finding in review mode flips the gate to FAIL.
2. Token file stays at 600 perms. Never echo the token, never log it.
3. Rate limit awareness. If the API returns 429, back off and retry once

after 60 seconds. After the second 429, surface the error.

1. No session state. Don't promise "continue the conversation" — the API

is stateless.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: oenco
• Source: oenco/claude-copilot-skill
• License: MIT

Install and usage instructions live in the source repository linked above.