Does the `-Force` Parameter Bypass the Reverse-Skill Authorization Gate?

The -Force (or --force) flag never bypasses the hard authorization gate that protects reverse-skill execution, regardless of how it is invoked.

The zhaoxuya520/reverse-skill repository implements a strict authorization gate that controls access to sensitive reverse-skill operations. Understanding the exact behavior of the -Force parameter is critical for developers and agents interacting with the gate script, as the flag functions as a compatibility option only and does not relax security checks.

How the Authorization Gate Enforces the -Force Restriction

The repository explicitly forbids the force flag from overriding gate checks in both policy documents and executable code.

Design Documentation in RULES.md

The authoritative design specification in RULES.md declares the restriction unambiguously. At line 21, the document states: "-Force/--force never bypasses the gate." This rule is absolute and applies to all invocations of the gate script.

Implementation in case-guard.sh

The gate script located at skills/scripts/case-guard.sh hard-codes this restriction. When the script detects the --force argument, it performs a final check at lines 22-25. Even when FORCE is set, the script prints:

CASE-GUARD: --force does not bypass scope hard gates.

It then exits with status 2 (failure), treating the unauthorized attempt exactly like a normal gate failure.

Confirmation in AGENTS.md

The high-level overview in AGENTS.md reinforces this behavior at line 21, stating that "-Force / --force 不得绕过这个硬门" (cannot bypass this hard gate). This consistency across documentation and implementation ensures no ambiguity in the security model.

The Three Hard Requirements for Gate Passage

The reverse-skill authorization gate enforces three mandatory conditions that cannot be overridden by the -Force parameter:

1. auth.status must be granted – The authentication layer must explicitly approve the session.
2. network_profile must be in a supported mode – Only offline with a sample, lab-only, or other approved network configurations are permitted.
3. ready_for_act must be true – The environment must signal readiness for action execution.

If any condition evaluates to false, the gate aborts with exit code 2, regardless of whether --force appears in the command arguments.

Code Examples: Why --force Fails to Bypass

The following terminal sessions demonstrate that the authorization gate rejects force-flagged invocations when prerequisites are missing.

Example 1: Force Flag Without Authorization

bash skills/scripts/case-guard.sh --case-root work/my-case --force

Output:

CASE-GUARD NOT READY: work/my-case
 - auth.status is not granted
 - ready_for_act is not true
CASE-GUARD: --force does not bypass scope hard gates.

The process terminates with exit code 2, identical to a non-force invocation.

Example 2: Standard Gate Failure (No Force)

bash skills/scripts/case-guard.sh --case-root work/my-case

This produces the same failure messages and exit code 2, confirming that --force provides no special exemption from the hard gate logic implemented in case-guard.sh.

Summary

• The -Force parameter is a compatibility option, not a bypass mechanism, according to the zhaoxuya520/reverse-skill source code.
• RULES.md (line 21), case-guard.sh (lines 22-25), and AGENTS.md (line 21) all explicitly prohibit the flag from overriding the authorization gate.
• The gate requires three specific conditions: auth.status=granted, a supported network_profile, and ready_for_act=true.
• Failure always results in exit code 2 and the diagnostic message: " --force does not bypass scope hard gates."

Frequently Asked Questions

Can I use --force to skip authentication in reverse-skill?

No. The --force flag cannot skip authentication or any other gate check. As defined in RULES.md and enforced in skills/scripts/case-guard.sh, the flag is strictly a compatibility marker and does not alter the gate's evaluation of auth.status, network_profile, or ready_for_act conditions.

What exit code does the gate return when --force is used without proper authorization?

The gate returns exit code 2 whenever authorization conditions are unmet, including when --force is present. This behavior is hard-coded in case-guard.sh at lines 22-25, ensuring consistent failure signaling for both forced and unforced invalid attempts.

Does AGENTS.md confirm the same restriction as RULES.md?

Yes. AGENTS.md at line 21 explicitly confirms that the -Force / --force parameter cannot bypass the hard gate ("不得绕过这个硬门"), providing cross-document verification of the security policy implemented in the shell script.

Is there any scenario where the authorization gate can be bypassed?

According to the source code analysis, there is no supported mechanism to bypass the authorization gate. The gate is designed as a hard requirement: all three conditions (auth.status, network_profile, ready_for_act) must be satisfied for successful execution, and no command-line flag currently overrides these checks.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}