L

LGTMgate

zigzag968/lgtmgate · v1.6.0-beta.1 · Development & Workflow

by Zigzag968Scan grade: AcceptableAwesome AI Plugins

Claude Code plugin that runs one Workflow per issue in its own git worktree, taking a GitHub issue to a reviewed PR with Theo, Sam, Nick and Morgan agents, and ticking each acceptance criterion only with cited evidence

InstallSourceClaim this plugin
Follow0
Trust Score74Security scan79Components8
Protect this install with HOL Guard

Guard checks the skills and MCP servers a plugin adds on your machine and asks you before a risky action runs. The scores above are free, and no plan changes them.

Is LGTMgate a fit?

From the plugin's manifest and HOL's scan. Anything the plugin does not declare is shown as not declared.

Works with

  • Claude Code
  • 8 skills
  • Runs hooks on agent events

Before you install

Sign-in
Not declared
Settings it asks for
Default pipeline mode
Declared access
Not declared
License
MIT

Check before relying on it

  • Some security checks did not finish: Cisco skill scan. See the evidence
  • The publisher has not verified ownership on HOL.

What is LGTMgate?

LGTMgate is a published development & workflow plugin for AI coding agents in the Claude Code ecosystem, developed by Zigzag968 and distributed through the HOL AI plugin registry. Claude Code plugin that runs one Workflow per issue in its own git worktree, taking a GitHub issue to a reviewed PR with Theo, Sam, Nick and Morgan agents, and ticking each acceptance criterion only with cited evidence.

Canonical slug
zigzag968/lgtmgate
Version
v1.6.0-beta.1 · updated Nov 2, 2026

Registry snapshot

Owner verification
Not verified
Marketplace source
.claude-plugin/marketplace.json
Scanner
HOL plugin scanner
Security result
Needs review
Digest verified
Yes
8 bundled skillsRead, copy or download each SKILL.mdOpen skills

Trust and security

Trust & reputation

74

HOL Trust Score

Per-metric points (0–100 each) combined via a weighted average into the overall score.

Installability
95/100
Maintenance
100/100
MCP server setup
100/100
Plugin Security
79/100
Provenance
70/100
Publisher Quality
75/100

Provenance

Plugin root
.
Source repo
https://github.com/Zigzag968/claude-code-lgtmgate
Source commit
8aabe0a66d08…
Publisher verified
No
Owner verified
Not owner verified
Agent Plugins 1.0
Not detected

Continuous scanner CI not detected

This plugin remains listed. Its overall trust score is reduced by 10% because security checks are not maintained in the source repository's CI.

Optional: maintain the scanner in the source repository's CI to receive the full trust score. Listing does not require that change.

README badge not detected

Plugin owners can add the HOL badge to the repository README from Guard Plugins. Distribution, not security evidence. It adds a 2% engagement adjustment to the overall trust score and never changes the security result.

Security posture

See how the Trust Score is computed
Needs review
Security result
79
Security score
0
High findings
Provider
codex-plugin-scanner
Grade
C · Acceptable
Version
3.24.2
codex:hol-plugin-scanner-7V7yzS / cisco-skill-scanner: timed_outcodex:hol-plugin-scanner-7V7yzS / cisco-mcp-scanner: skipped

[claude:.] Claude Plugin

13/18

5 checks

[claude:.] Security

16/16

6 checks

[claude:.] Operational Security

3/6

5 checks

[claude:.] Code Quality

10/10

2 checks

[codex:.] Manifest Validation

18/31

9 checks

[codex:.] Security

16/16

9 checks

[codex:.] Operational Security

3/6

5 checks

[codex:.] Best Practices

9/12

5 checks

[codex:.] Marketplace

N/A

3 checks · not applicable

[codex:.] Skill Security

5/5

4 checks

[codex:.] Code Quality

10/10

2 checks

Published advisories

None matched in GitHub security advisories, checked . This covers published advisories only, not problems nobody has reported.

GitHub security advisories are those the source repository has published.

Findings

lowsecurityCLAUDE_VERSION_BAD_SEMVER

The version "1.6.0-beta.1" does not match X.Y.Z.

Use semver in .claude-plugin/plugin.json.

lowoperational-securityDEPENDABOT_MISSINGReported 2 times

Automation or dependency surfaces exist, but .github/dependabot.yml is missing.

Add Dependabot updates for GitHub Actions and dependency manifests.

lowmanifest-validationPLUGIN_JSON_BAD_SEMVER

The version "1.6.0-beta.1" does not match the documented semver format.

Use a version like 1.2.3 in plugin.json.

infomanifest-validationPLUGIN_JSON_RECOMMENDED_HOMEPAGE

The manifest is missing the documented recommended field "homepage".

Add "homepage" to strengthen the plugin manifest metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_SHORTDESCRIPTION

The interface object is missing a valid "shortDescription" value.

Add a valid "shortDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_LONGDESCRIPTION

The interface object is missing a valid "longDescription" value.

Add a valid "longDescription" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_CATEGORY

The interface object is missing a valid "category" value.

Add a valid "category" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_CAPABILITIES

The interface object is missing a valid "capabilities" value.

Add a valid "capabilities" field to the interface metadata.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_WEBSITEURL

The interface field "websiteURL" must use HTTPS or point to a safe in-repo asset.

Update "websiteURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_PRIVACYPOLICYURL

The interface field "privacyPolicyURL" must use HTTPS or point to a safe in-repo asset.

Update "privacyPolicyURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_TERMSOFSERVICEURL

The interface field "termsOfServiceURL" must use HTTPS or point to a safe in-repo asset.

Update "termsOfServiceURL" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_COMPOSERICON

The interface field "composerIcon" must use HTTPS or point to a safe in-repo asset.

Update "composerIcon" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_LOGO

The interface field "logo" must use HTTPS or point to a safe in-repo asset.

Update "logo" to use HTTPS or an existing relative asset path.

infomanifest-validationPLUGIN_JSON_INTERFACE_ASSET_SCREENSHOTS

The interface field "screenshots" must use HTTPS or point to a safe in-repo asset.

Update "screenshots" to use HTTPS or an existing relative asset path.

infobest-practicesCODEXIGNORE_MISSING

A .codexignore file helps prevent accidental inclusion of local artifacts and secrets.

Add a .codexignore file with generated assets, local state, and secret paths.

Install guidance

Install in Claude Code

Install through the Claude Code plugin marketplace.

Claude Code plugin docs

Optional: install HOL Guard for Claude Code first, so it can check this plugin's tools on your machine before Claude Code uses them.

  1. 1

    Add the marketplace

    Run this inside a Claude Code session. It registers the marketplace manifest shipped at the repository root. If the repository ships none, add the generated entry from the Advanced section below first.

    claude code
  2. 2

    Install the plugin

    Installs the lgtmgate entry from the zigzag-plugins marketplace.

    claude code
  3. 3

    Scripted alternative

    Non-interactive equivalent for scripts and CI pipelines. Add --scope project to pin the install to one repository.

    shell
  4. 4

    Check it is installed

    Lists installed plugins. The entry should appear as enabled.

    shell

To remove it later, run claude plugin uninstall lgtmgate@zigzag-plugins.

Did setup work in Claude Code?

No setup reports for Claude Code yet. Self-reported by signed-in visitors. Copying a command is not counted, and most installs are never reported.

Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W44, so no number is shown. Counted from opt-in HOL Guard install reports, once per machine and runtime, and never mixed with the answers above. How install reports work.

Loading reviews

Plugin manifest

{
  "name": "lgtmgate",
  "version": "1.6.0-beta.1",
  "description": "Stack-agnostic delivery pipeline: Theo (diagnose) -> Mia (PM) -> Sam (plan) -> Nick (dev+PR) -> Morgan (review), orchestrated by a per-project workflow and configured via .claude/pipeline.config.json.",
  "author": {
    "name": "Zigzag968"
  },
  "repository": "https://github.com/Zigzag968/claude-code-lgtmgate",
  "license": "MIT",
  "keywords": [
    "pipeline",
    "agents",
    "orchestration",
    "code-review",
    "worktree"
  ],
  "hooks": "./hooks/plugin-hooks.json",
  "userConfig": {
    "default_mode": {
      "type": "string",
      "title": "Default pipeline mode",
      "description": "Default orchestration mode for /lgtmgate:deliver (auto = run through, semi = stop at milestones, manual = stop at each stage).",
      "default": "auto"
    }
  },
  "interface": {
    "displayName": "lgtmgate",
    "developerName": "Zigzag968"
  },
  "skills": "./",
  "holManifestOrigin": "repository",
  "registryIndexVersion": 9
}

Marketplace source

Repo URL
https://github.com/Zigzag968/claude-code-lgtmgate
Marketplace path
.claude-plugin/marketplace.json
Source path
.
Install policy
Unspecified

Skills

8 SKILL.md files ship with this plugin. Preview, copy, or download each one, then install them with the Skills CLI.

Share
skills-cli

  • run-probe-evals

    .claude/skills/run-probe-evals/SKILL.md

    Run or debug the probe evals of issue #81 (`claude plugin eval` on evals/probe-*, in Docker; the gate is at least 29 of 30 runs fully passed, a 0.95 mean is not enough). Use when the probe layer changed, at the E2 gate, or when a probe eval case scores below 1.00.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • file

    plugins/backlog/skills/file/SKILL.md

    File one well-formed backlog issue (dry run first, create only as the repo mode allows)

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • next

    plugins/backlog/skills/next/SKILL.md

    Print the next backlog issue an agent may pick up (read-only)

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • triage

    plugins/backlog/skills/triage/SKILL.md

    Propose label fixes for inbox and needs-info issues; never applies them

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • context

    skills/context/SKILL.md

    Show what project specifics each agent will receive at the next launch (table by default, one role's text on request, or a read-only audit of the context files).

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • deliver

    skills/deliver/SKILL.md

    Deliver a change end-to-end through the Theo -> Sam -> Nick -> Morgan pipeline, Mia framing first only when asked (creates the shared worktree, drives deliver-pipeline.js).

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • doctor

    skills/doctor/SKILL.md

    One read-only verdict on the setup (plugin installs, config, init copies, certificate bundle, disk space, agents context) before the first launch, with the exact command for each finding.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

  • init

    skills/init/SKILL.md

    Bootstrap the lgtmgate in this project — copy templates, generate pipeline.config.json, wire GH + settings.

    Raw SKILL.md

    SKILL.md content is not in this snapshot. Open the raw file to copy it from the source repository.

File inventory

.claude-plugin/marketplace.json

file

1,700 bytes

10a54a2c1a128fd7…

.claude-plugin/plugin.json

file

819 bytes

ac8001659a317403…

.claude/skills/run-probe-evals/SKILL.md

skill

8,411 bytes

5ff2c1937784924d…

.codex-plugin/plugin.json

plugin-manifest

861 bytes

78eb796cd02cd7c6…

AGENTS.md

file

264 bytes

4df49815b79aaec1…

agents/mia.md

file

4,255 bytes

2dfd66f931c7e718…

agents/morgan.md

file

14,061 bytes

812e27432d338526…

agents/nick.md

file

8,981 bytes

873606892cac3a2f…

agents/probe.md

file

1,489 bytes

602eb56c8f018bb6…

agents/sam.md

file

15,768 bytes

511e3483ce1e3cc8…

agents/theo.md

file

3,869 bytes

60b6e445cd5123cd…

eslint.config.js

file

2,520 bytes

e11a93a58e7fd5f5…

hooks/block-merge-unchecked.sh

file

6,037 bytes

0d0de5ead1206d6a…

hooks/deny-destructive-git.sh

file

10,354 bytes

c2ce2f8ca4a34fec…

hooks/lib-worktree-root.sh

file

1,883 bytes

7065b031806a000c…

hooks/pii-guard.sh

file

3,680 bytes

c34071624d4f11e5…

hooks/plugin-hooks.json

file

3,498 bytes

c2073e67938dfb5b…

hooks/PostToolUse-probe-attest.sh

file

3,270 bytes

055bb5d9a3f84a26…

hooks/SessionStart/inject_stub.py

file

16,726 bytes

87c0aeae178a4862…

hooks/Stop-supervise-runs.sh

file

9,291 bytes

2d46472ed44b2114…

hooks/SubagentStop-probe.sh

file

2,047 bytes

8e0d88ecd9c9b4d3…

hooks/SubagentStop-worktree-cleanup.sh

file

1,342 bytes

37d86e36d02729d6…

hooks/workflow-args-expand.sh

file

1,003 bytes

43470d3d0e9a537c…

LICENSE

file

1,424 bytes

c785803db2202c48…

package-lock.json

file

125,716 bytes

4792785657a91e9d…

package.json

file

396 bytes

a5528a4a26038f0a…

plugins/backlog/skills/file/SKILL.md

skill

2,033 bytes

43f7bf03985c1b6c…

plugins/backlog/skills/next/SKILL.md

skill

782 bytes

84fb531416cd1c45…

plugins/backlog/skills/triage/SKILL.md

skill

1,759 bytes

1dd030fbfede5ffa…

README.md

file

36,105 bytes

759d043fac2c6fda…

SECURITY.md

file

4,168 bytes

bbd870b1ad3a8728…

skills/context/SKILL.md

skill

2,774 bytes

036f8fd16e10fbc3…

skills/deliver/SKILL.md

skill

54,831 bytes

2883f2d41713c0df…

skills/doctor/SKILL.md

skill

2,325 bytes

61903893ad75c9fa…

skills/init/SKILL.md

skill

20,063 bytes

e4dccb95f70ed7e1…

LGTMgate — Frequently asked questions

What is LGTMgate?
LGTMgate is an AI plugin in the HOL registry. Claude Code plugin that runs one Workflow per issue in its own git worktree, taking a GitHub issue to a reviewed PR with Theo, Sam, Nick and Morgan agents, and ticking each acceptance criterion only with cited evidence.
How do I install LGTMgate?
Install LGTMgate in your harness: Claude Code — /plugin marketplace add Zigzag968/claude-code-lgtmgate; Any agent — npx [email protected] add Zigzag968/claude-code-lgtmgate. Full step-by-step guidance is on the HOL plugin page.
How do I install LGTMgate in HOL Guard?
To install LGTMgate in HOL Guard, start with hol-guard plugin install zigzag968/lgtmgate --apply. The complete step-by-step install guide for HOL Guard is on the HOL plugin page.
How do I install LGTMgate in Claude Code?
To install LGTMgate in Claude Code, start with /plugin marketplace add Zigzag968/claude-code-lgtmgate. The complete step-by-step install guide for Claude Code is on the HOL plugin page.
How is the Trust Score for LGTMgate computed?
LGTMgate has a HOL Trust Score of 74 out of 100. The score is a weighted sum of six components from a static scan of the source, capped for high-severity findings and adjusted by two disclosed policies. Memberships and payments are not inputs, and a scan is not a safety guarantee. Full breakdown: https://hol.org/registry/plugins/zigzag968%2Flgtmgate/trust
Who publishes LGTMgate?
LGTMgate is published by Zigzag968 and listed on HOL.

Directory acceptance

Listed in 0 of 5 directory lists

Read from the list each directory publishes on GitHub. Being listed means the directory accepted the plugin; it is not a HOL security rating.

Lists last read . HOL re-reads them every day.

Submitting it? Check it against each directory's rules

Install signal

HOL cannot see every install. These are separate signals from different sources, so they are not added together. Counts under each floor show as <N.

Install commands issued here
<5
HOL Guard install commands issued from this listing, last 28 days.
Opt-in install reports
<10
Machines that reported installing it through HOL Guard in week 2026-W44. Reporting is opt-in, so most installs are not counted.
HOL Guard workspaces
<5
Workspaces that approved it or include it in an approved-plugin feed, as of today.

Related plugins

Ordered by Trust Score. Listings cannot pay for these positions. Check each one fits your task before switching from LGTMgate.

Alternatives in Development & Workflow

See all Development & Workflow plugins

Reviews and similar plugins