Review Agent Setup
This gates AI agent actions that touch external surfaces like PR reviews, merges, CI configs, and issue comments behind explicit human approval. Every attempt gets an Ed25519-signed receipt whether you allow it or deny it, so you have a cryptographically verifiable audit trail. You drop a flag file or use a slash command to open an approval window, the agent runs its action, then you close the window. It's overkill if your agent is just editing local files, but if you're letting Claude post reviews or push to protected branches and need to prove a human was in the loop, this is the tooling for it. Works alongside protect-mcp for layered policy enforcement.
- skills.sh installs
- 5.6K
- GitHub stars
- 42.4K
- last updated
- Aug 21, 2026
Install
$ npx -y skills add wshobson/agents --skill review-agent-setup --agent claude-codeInstalls into .claude/skills of the current project.
Files
review-agent-governance — Setup
Gate AI agent review actions (PR reviews, comments, merges, CI edits) behind explicit human approval. Every attempt, approved or denied, produces an Ed25519-signed receipt.
When to use this plugin
Install it in projects where a Claude Code agent:
- Reviews, comments on, or merges pull requests (
gh pr review,gh pr merge) - Triages issues (
gh issue comment,gh issue close) - Publishes releases (
gh release create) - Modifies CI configuration (
.github/workflows/,.gitlab-ci.yml) - Pushes to protected branches (
main,master,release,production) - Posts to external notification surfaces (Slack webhooks, Discord), once you add a rule for the command that posts (the default policy does not gate them)
If the agent is only doing local file edits and running tests, this plugin is
overkill. Use protect-mcp for general tool-call policy enforcement and skip
this one.
One-time setup
1. Install the plugin
claude plugin install wshobson/agents/review-agent-governance
2. Copy the default policy to your project
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/wshobson/agents
- Categories
- Git & Pull Requests, Code Review & Quality, AI & Agent Building
- First seen
- May 16, 2026
More from wshobson/agents
All 174- Scan5K
- Recsys Pipeline Architect4.6K
- Social Publishing4K
- Before You Build3.5K
- File Conversion3.4K
- Ai Debt Detector3.4K
- Session Guard3.2K
- Dataset Curation3K
- Eval Harness First3K
- Lora Qlora Recipes3K
- Finetuning Method Selection3K
- Preference Optimization2.9K
- Quantized Export2.9K
- Pptx Reference Deck Analysis2.9K
- Grpo Rlvr Training2.9K
- Checkpoint Promotion2.9K
- Trace To Training Data2.9K
- Vision Sft2.9K
- Spark Memory Thermal Ops2.9K
- Spark Training Gotchas2.9K
- Spark Environment Setup2.9K
- Typescript Advanced Types98.8K
- Tailwind Design System72.7K
- Nodejs Backend Patterns49.8K
Recommended
More Git & Pull Requests
git-cleanuptrailofbits/skillsSafely analyzes and cleans up local git branches and worktrees by categorizing them as merged, squash-merged, superseded, or active work.4Kskills.sh installs
ce-code-revieweveryinc/compound-engineering-pluginStructured code review for bugs, regressions, tests, and standards. Use before PRs or when asked for review; report-only by default, with explicit local apply a3.9Kskills.sh installs
nextjs-code-reviewgiuseppe-trisciuoglio/developer-kitProvides comprehensive code review capability for Next.js applications, validates Server Components, Client Components, Server Actions, caching strategies, meta3.9Kskills.sh installs
design-reviewnexu-io/open-designDesigner Who Codes: visual audit then fixes with atomic commits and before/after screenshots. Useful for tightening shipped UI before launch.3.3Kskills.sh installsplan-design-reviewnexu-io/open-designSenior Designer review: rates each design dimension 0-10, explains what a 10 looks like, and flags AI Slop signals. Useful as a gate before merging UI work.3Kskills.sh installs
github-deep-researchbytedance/deer-flowConduct multi-round deep research on any GitHub Repo. Use when users request comprehensive analysis, timeline reconstruction, competitive analysis, or in-depth 2.9Kskills.sh installs