Community생산성 & 협업github.com

wshobson/review-agent-setup

AI 에이전트가 수행하는 PR 검토 작업에 대해 사람의 개입을 통한 게이팅(Human-in-the-loop)을 Claude Code에서 설정합니다. 에이전트가 PR 리뷰, 댓글, 머지, CI 설정 편집 등을 수행할 수 있는 프로젝트에서 암호화 방식으로 감사 가능한 승인 내역과 Cedar 기반 게이트를 원할 때 사용하세요.

review-agent-setup란 무엇인가요?

이 스킬은 Claude Code에서 AI 에이전트가 PR 리뷰, 댓글, 머지, CI 설정 편집과 같은 민감한 작업을 수행할 때 사람의 승인을 필수로 요구하는 게이팅 시스템을 설정합니다. Cedar 정책 언어를 기반으로 한 세분화된 접근 제어와 암호화 서명을 통해 모든 승인 과정을 감사 가능하게 만들어, 규정 준수 및 보안 요구사항을 충족시킵니다. 주요 기능으로는 작업별 최소 승인자 수, 승인자 목록, 조직 및 저장소 수준의 정책 설정, 그리고 git 서명된 증명 생성을 지원합니다. 이 스킬은 주로 Claude Code 환경에서 사용되며, 설정이 완료되면 에이전트가 게이트를 통과하지 못한 작업은 자동으로 차단됩니다.

지원 대상✓Claude Code~Codex CLI~Cursor
npx skills add https://github.com/wshobson/agents/tree/main/skills/review-agent-setup

Installed? Explore more 생산성 & 협업 skills: steipete/gemini, steipete/gh-issues, steipete/skill-creator · View all 6 →

즐겨 사용하는 AI에게 물어보기

이 에이전트 스킬이 미리 로드된 새 채팅을 엽니다.

문서

review-agent-setup은(는) 무엇을 하나요?

Claude Code에서 AI 에이전트의 PR 검토 작업에 대해 사람의 개입을 통한 게이팅(Human-in-the-loop)을 설정합니다. 에이전트가 PR 리뷰, 댓글, 머지, 또는 CI 설정 편집을 수행할 수 있는 프로젝트에서 암호화 방식으로 감사 가능한 승인 내역과 Cedar 기반 게이트를 원할 때 사용하세요.

사용 방법

  1. 스킬 호출 - 프로젝트의 .claude/settings.json에 이 스킬을 추가합니다.
  2. 설정 파일 생성 - cedar-policy.json 및 approval-config.json 파일을 프로젝트 루트에 생성합니다.
  3. 게이트 정의 - 승인 정책과 최소 승인자 수, 승인자 목록을 정의합니다.
  4. 에이전트 사용 - Claude Code가 설정된 게이트를 자동으로 준수합니다.

설정 예시

approval-config.json

{
  "minApprovals": 1,
  "approvers": ["user1", "user2"],
  "orgPolicies": {
    "requireApprovalFor": ["merge", "ci-config-edit"]
  },
  "audit": {
    "signingKey": "your-gpg-key-id"
  }
}

cedar-policy.json

{
  "policies": [
    {
      "effect": "forbid",
      "principal": "ClaudeCode",
      "action": ["MergePR", "EditCIConfig"],
      "condition": {
        "not": {
          "hasApproval": {
            "count": 1
          }
        }
      }
    }
  ]
}

지원 기능

  • 게이트 유형: PR 리뷰, 댓글, 머지, CI 설정 편집
  • 정책 언어: Cedar (AWS 기반 정책 엔진)
  • 감사 추적: GPG 서명된 승인 증명
  • 승인 제어: 최소 승인자 수, 특정 승인자 목록
  • 범위 설정: 조직 수준, 저장소 수준, 작업 수준

참고 사항

  • 모든 설정 파일은 버전 관리에 포함하는 것을 권장합니다.
  • GPG 키는 안전하게 보관하고, 팀 내에서 공유하지 마십시오.
  • 승인 정책이 너무 엄격하면 생산성이 저하될 수 있으므로 적절한 균형을 유지하세요.

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

wshobson/accessibility-compliance

Implement WCAG 2.2 compliant interfaces with mobile accessibility, inclusive design patterns, and assistive technology support. Use when auditing accessibility, implementing ARIA patterns, building for screen readers, or ensuring inclusive user experiences.

wshobson/airflow-dag-patterns

Build production Apache Airflow DAGs with best practices for operators, sensors, testing, and deployment. Use when creating data pipelines, orchestrating workflows, or scheduling batch jobs.

wshobson/angular-migration

Migrate from AngularJS to Angular using hybrid mode, incremental component rewriting, and dependency injection updates. Use when upgrading AngularJS applications, planning framework migrations, or modernizing legacy Angular code.

wshobson/anti-reversing-techniques

Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.

wshobson/api-design-principles

Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.

wshobson/architecture-decision-records

Write and maintain Architecture Decision Records (ADRs) following best practices for technical decision documentation. Use when documenting significant technical decisions, reviewing past architectural choices, or establishing decision processes.

wshobson/architecture-patterns

Implement proven backend architecture patterns including Clean Architecture, Hexagonal Architecture, and Domain-Driven Design. Use this skill when designing clean architecture for a new microservice, when refactoring a monolith to use bounded contexts, when implementing hexagonal or onion architecture patterns, or when debugging dependency cycles between application layers.

wshobson/async-python-patterns

Master Python asyncio, concurrent programming, and async/await patterns for high-performance applications. Use when building async APIs, concurrent systems, or I/O-bound applications requiring non-blocking operations.

wshobson/attack-tree-construction

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

wshobson/auth-implementation-patterns

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

wshobson/avoid-ai-writing

Audit and rewrite prose so it stops reading as machine-generated. Use this skill when asked to remove AI-isms, clean up AI writing, edit a draft for AI tells, audit a README, changelog, release note, PR description, or blog post for machine-sounding prose, or make text sound less like AI. Supports a detect-only mode, a rewrite mode, and an edit-in-place mode, with optional voice and context profiles.

wshobson/backtesting-frameworks

Build robust backtesting systems for trading strategies with proper handling of look-ahead bias, survivorship bias, and transaction costs. Use when developing trading algorithms, validating strategies, or building backtesting infrastructure.

wshobson/bash-defensive-patterns

Master defensive Bash programming techniques for production-grade scripts. Use when writing robust shell scripts, CI/CD pipelines, or system utilities requiring fault tolerance and safety.

wshobson/bats-testing-patterns

Master Bash Automated Testing System (Bats) for comprehensive shell script testing. Use when writing tests for shell scripts, CI/CD pipelines, or requiring test-driven development of shell utilities.

wshobson/bazel-build-optimization

Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.

wshobson/before-you-build

Pre-build product and feature risk review for founders, product managers, and AI-assisted builders. Use this skill when the user is about to build a landing page, MVP, SaaS product, internal tool, agent workflow, or major feature and needs to check demand, positioning, monetization, retention, trust, distribution, and adoption risk before implementation starts.

wshobson/billing-automation

Build automated billing systems for recurring payments, invoicing, subscription lifecycle, and dunning management. Use when implementing subscription billing, automating invoicing, or managing recurring payment systems.

wshobson/binary-analysis-patterns

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.

wshobson/block-no-verify-hook

Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.

wshobson/brand-landingpage

Brand-first landing page designer — runs a brand-identity interview (colors, typography, shape language), then generates and iterates on a polished landing page via Stitch with deployment-ready HTML. Use when the user asks to create, design, or build a landing page, homepage, or marketing page and has no established visual direction. Skip when they have a design mockup, need a dashboard or app UI, are working at component level, building a multi-page app, or restyling with known design tokens — use frontend-design instead.

관련 스킬