# Can You Bypass the reverse-skill Authorization Gate with -Force or --force? > Discover if -Force or --force flags bypass the reverse-skill authorization gate. Learn why these flags cannot skip authentication for the scope.md file. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-21 --- **No, the `-Force` and `--force` flags cannot bypass the authorization gate in reverse-skill; the repository explicitly prohibits these flags from skipping the authentication check required to access the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file.** The `reverse-skill` repository implements a strict authorization gate to protect case scope initialization from unauthorized access. While some command-line tools allow force flags to override security prompts, attempting this shortcut in reverse-skill will fail because the gate is architected to be non-bypassable. Understanding why requires examining both the declarative rules and the script logic that enforces them. ## Why Force Flags Are Explicitly Blocked According to the repository's governance documentation, force arguments are categorically barred from circumventing security controls. In [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), the routing workflow description includes the definitive statement: **"‑Force/‑‑force never bypasses the gate."** This explicit prohibition appears at lines 21-22 and is reinforced in the compact reminder section at lines 96-98. The documentation references [`skills/config/routing.json`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/config/routing.json) as the source of routing decisions, embedding the authorization gate directly into the core workflow path. Because the gate is part of the routing logic rather than a simple prompt, no command-line flag can override it—the system simply does not evaluate force parameters when determining whether to proceed. ## How the case-init Script Enforces Authentication The enforcement logic resides in [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh), which constructs the case scope and validates credentials before any action occurs. At lines 45-55 and 104-112, the script performs the following checks: - It verifies the `auth.status` field in the generated [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file - It requires `auth.status = granted` to proceed - It never evaluates a `‑Force` or `--force` argument in its decision logic If the authorization status is missing or invalid, the workflow stops immediately and prompts the user to provide a valid authorization preset. The script does not branch based on force flags; it only branches on the authentication state. ## Correctly Passing the Authorization Gate Since force flags are ignored, you must use approved presets to satisfy the authentication requirement. The valid presets include `offline-sample` and `ctf-public`, which set `auth.status` to "granted" through legitimate means. Use the following syntax for Bash: ```bash # Correct usage with valid preset bash skills/scripts/case-init.sh --hint "apk reverse" --preset offline-sample --sample ./app.apk ``` And for PowerShell: ```powershell # Correct usage with valid preset powershell -File skills/scripts/case-init.ps1 -Hint "apk reverse" -Preset offline-sample -Sample .\app.apk ``` Both the Bash ([`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh)) and PowerShell (`case-init.ps1`) implementations follow identical logic and require the same authentication flow. ## Incorrect Usage: What Happens When You Try --force Attempting to append force flags results in the arguments being ignored by the parsing logic. The script will still halt at the authorization check and request proper credentials. ```bash # Incorrect - the flag is ignored and auth is still required bash skills/scripts/case-init.sh --hint "apk reverse" --force ``` ```powershell # Incorrect - no effect on the authorization gate powershell -File skills/scripts/case-init.ps1 -Hint "apk reverse" -Force ``` In both cases, the workflow stops at the `auth.status` validation step in [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (lines 45-55) and refuses to generate the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file until a valid preset is provided. ## Summary - The `-Force` and `--force` flags are **explicitly prohibited** from bypassing the authorization gate per [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) lines 21-22 and 96-98. - The `case-init` script enforces authentication by requiring `auth.status = granted` and never evaluates force arguments. - Valid authorization requires using **presets** like `offline-sample` or `ctf-public` via the `--preset` parameter. - Both Bash and PowerShell initialization scripts implement identical gate logic and will ignore force flags. ## Frequently Asked Questions ### Can any flag bypass the reverse-skill authorization gate? No. According to the repository's routing workflow documented in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), no command-line flag exists that can skip the authentication check. The gate requires a valid `auth.status` value set exclusively through approved presets. ### What files control the authorization enforcement? The authorization rules are defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md), while the enforcement mechanism resides in [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) (lines 45-112). This script validates the `auth.status` field before generating the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file that controls case access. ### How do I legally authenticate for case initialization? Use the `--preset` parameter with valid values such as `offline-sample` or `ctf-public`. This sets the required `auth.status` to "granted" without violating the security workflow defined in the repository's core rules. ### Does the PowerShell version behave differently than Bash? No. Both [`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh) and `skills/scripts/case-init.ps1` implement identical authorization logic. Both scripts ignore the `-Force` parameter and require the same `auth.status` validation to proceed past the gate.