Skip to content
Get packs

Review Agent Approval Gate

Blocks an AI agent's PR reviews, merges, and CI edits until a human approves each one, with signed receipts

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
1 file

What it does

Once installed, Claude Code will refuse by default to let the agent take review-surface actions such as approving or commenting on pull requests, merging, closing issues, publishing releases, or editing CI configuration. A human opens a short approval window (a flag file or a slash command) before the action and closes it afterward. Each allowed or denied attempt is meant to produce an Ed25519-signed receipt that can be checked offline with a public key, giving a verifiable audit trail.

Great for

  • Teams that let a Claude Code agent interact with GitHub or GitLab repositories and want a human sign-off step
  • Maintainers who need an auditable record of which agent actions were approved
  • Security-minded projects that want deny-by-default rules on merges and CI changes

Skip it if

  • Projects where the agent only edits local files and runs tests; the skill's own docs say this is overkill and suggest protect-mcp instead
  • Anyone expecting a tamper-proof system: the approval log is unsigned, and the approval flag is a plain file the agent could also create unless permissions prevent it
  • Unattended CI pipelines that need approvals to happen automatically, since each approval requires a human to open a window

Try asking

  • “Set up human approval gating for an agent that will review and comment on pull requests in this repo”
  • “Make sure the agent cannot merge to main or edit .github/workflows without my approval”
  • “Show me how to approve one specific PR review and verify the signed receipts afterward”
  • “Lock this project down so every review-surface action is denied during an audit run”
Step-by-step guide: how to use Review Agent Approval GateInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    review-agent-setup.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip review-agent-setup.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip review-agent-setup.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Keep ./review-governance.key out of git (the setup adds it to .gitignore) and give auditors only the publicKey value; check .gitignore actually contains these entries
  • Close approval windows right after each action, and prefer the slash command's recorded reason so approvals are at least documented, even though that log is unsigned
  • Review the default Cedar policy before relying on it, because the default does not gate Slack or Discord posts and you must add rules yourself

What's inside

  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.