review-agent-setup
Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates.
Profile →npx skills add wshobson/agents --skill review-agent-setup --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# review-agent-governance — Setup Gate AI agent review actions (PR reviews, comments, merges, CI edits) behind explicit human approval. Every attempt, approved or denied, produces an Ed25519-signed receipt. ## When to use this plugin Install it in projects where a Claude Code agent: - Reviews, comments on, or merges pull requests (`gh pr review`, `gh pr merge`) - Triages issues (`gh issue comment`, `gh issue close`) - Publishes releases (`gh release create`) - Modifies CI configuration (`.github/workflows/`, `.gitlab-ci.yml`) - Pushes to protected branches (`main`, `master`, `release`, `production`) - Posts to external notification surfaces (Slack webhooks, Discord) If the agent is only doing local file edits and running tests, this plugin is overkill. Use `protect-mcp` for general tool-call policy enforcement and skip this one. ## One-time setup ### 1. Install the plugin ```bash claude plugin install wshobson/agents/review-agent-governance ``` ### 2. Copy the default policy to your project ```bash cp .claude/plugins/review-agent-governance/policies/review-agent-governance.cedar \ ./review-governance.cedar ``` You can edit this file to match your project's specific rules. See `../a
- When to use this plugin
- One-time setup
- 1. Install the plugin
- 2. Copy the default policy to your project
- 3. Create a receipts directory and sign key
- Per-session workflow
- Flag file (simplest)
- Slash command (from within Claude Code)
- Dry-run everything (force full policy evaluation)
- Verifying the chain
- Example: approving a PR review
- Composing with protect-mcp
- Standards
claude plugin install wshobson/agents/review-agent-governance cp .claude/plugins/review-agent-governance/policies/review-agent-governance.cedar \ mkdir -p ./review-receipts echo "./review-receipts/" >> .gitignore echo "./review-governance.key" >> .gitignore echo "./.review-approved" >> .gitignore Before the action you want to approve touch ./.review-approved Let Claude Code run the review / comment / merge Immediately after
What does the review-agent-setup skill do?
Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates.
How do I install it?
Run `npx skills add wshobson/agents --skill review-agent-setup --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From wshobson/agents, a repository with 38,479 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.