# Does the `-Force` Parameter Bypass the Reverse-Skill Authorization Gate?

> Discover if the -Force parameter bypasses the reverse-skill authorization gate. Learn why this flag never bypasses the hard authorization protecting reverse-skill execution.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-29

---

**The `-Force` (or `--force`) flag never bypasses the hard authorization gate that protects reverse-skill execution, regardless of how it is invoked.**

The `zhaoxuya520/reverse-skill` repository implements a strict authorization gate that controls access to sensitive reverse-skill operations. Understanding the exact behavior of the `-Force` parameter is critical for developers and agents interacting with the gate script, as the flag functions as a compatibility option only and does not relax security checks.

## How the Authorization Gate Enforces the `-Force` Restriction

The repository explicitly forbids the force flag from overriding gate checks in both policy documents and executable code.

### Design Documentation in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)

The authoritative design specification in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) declares the restriction unambiguously. At **line 21**, the document states: "`-Force/--force` never bypasses the gate." This rule is absolute and applies to all invocations of the gate script.

### Implementation in [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh)

The gate script located at [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh) hard-codes this restriction. When the script detects the `--force` argument, it performs a final check at **lines 22-25**. Even when `FORCE` is set, the script prints:

```text
CASE-GUARD: --force does not bypass scope hard gates.

```

It then exits with **status 2** (failure), treating the unauthorized attempt exactly like a normal gate failure.

### Confirmation in [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md)

The high-level overview in [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) reinforces this behavior at **line 21**, stating that "`-Force` / `--force` 不得绕过这个硬门" (cannot bypass this hard gate). This consistency across documentation and implementation ensures no ambiguity in the security model.

## The Three Hard Requirements for Gate Passage

The reverse-skill authorization gate enforces three mandatory conditions that cannot be overridden by the `-Force` parameter:

1. **`auth.status` must be `granted`** – The authentication layer must explicitly approve the session.
2. **`network_profile` must be in a supported mode** – Only offline with a sample, lab-only, or other approved network configurations are permitted.
3. **`ready_for_act` must be `true`** – The environment must signal readiness for action execution.

If any condition evaluates to false, the gate aborts with **exit code 2**, regardless of whether `--force` appears in the command arguments.

## Code Examples: Why `--force` Fails to Bypass

The following terminal sessions demonstrate that the authorization gate rejects force-flagged invocations when prerequisites are missing.

### Example 1: Force Flag Without Authorization

```bash
bash skills/scripts/case-guard.sh --case-root work/my-case --force

```

**Output:**

```text
CASE-GUARD NOT READY: work/my-case
 - auth.status is not granted
 - ready_for_act is not true
CASE-GUARD: --force does not bypass scope hard gates.

```

The process terminates with exit code **2**, identical to a non-force invocation.

### Example 2: Standard Gate Failure (No Force)

```bash
bash skills/scripts/case-guard.sh --case-root work/my-case

```

This produces the same failure messages and exit code **2**, confirming that `--force` provides no special exemption from the hard gate logic implemented in [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh).

## Summary

- The `-Force` parameter is a **compatibility option**, not a bypass mechanism, according to the `zhaoxuya520/reverse-skill` source code.
- **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)** (line 21), **[`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh)** (lines 22-25), and **[`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md)** (line 21) all explicitly prohibit the flag from overriding the authorization gate.
- The gate requires three specific conditions: `auth.status=granted`, a supported `network_profile`, and `ready_for_act=true`.
- Failure always results in **exit code 2** and the diagnostic message: " `--force` does not bypass scope hard gates."

## Frequently Asked Questions

### Can I use `--force` to skip authentication in reverse-skill?

No. The `--force` flag cannot skip authentication or any other gate check. As defined in [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md) and enforced in [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh), the flag is strictly a compatibility marker and does not alter the gate's evaluation of `auth.status`, `network_profile`, or `ready_for_act` conditions.

### What exit code does the gate return when `--force` is used without proper authorization?

The gate returns **exit code 2** whenever authorization conditions are unmet, including when `--force` is present. This behavior is hard-coded in [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) at lines 22-25, ensuring consistent failure signaling for both forced and unforced invalid attempts.

### Does [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) confirm the same restriction as [`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)?

Yes. [`AGENTS.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/AGENTS.md) at line 21 explicitly confirms that the `-Force` / `--force` parameter cannot bypass the hard gate ("不得绕过这个硬门"), providing cross-document verification of the security policy implemented in the shell script.

### Is there any scenario where the authorization gate can be bypassed?

According to the source code analysis, there is **no supported mechanism** to bypass the authorization gate. The gate is designed as a hard requirement: all three conditions (`auth.status`, `network_profile`, `ready_for_act`) must be satisfied for successful execution, and no command-line flag currently overrides these checks.