# Does the -Force Flag Bypass Authorization in Reverse-Skill? > Discover if the -Force flag bypasses authorization in reverse-skill. Learn how this compatibility flag maintains security and scope gate checks. - Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) - Tags: how-to-guide - Published: 2026-08-24 --- **The `-Force`/`--force` flag in reverse-skill does not bypass authorization; it is strictly a compatibility flag for legacy command-line signatures that preserves syntax while maintaining all hard scope gate checks.** If you are working with the zhaoxuya520/reverse-skill repository and wondering whether the `--force` option grants elevated privileges or skips security validations, the answer is definitively no. According to the source code in [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh), this flag exists solely to maintain backward compatibility with legacy command patterns, but the script enforces the same rigorous authorization checks regardless of whether the flag is present. ## What the --force Flag Actually Does in case-guard.sh The `--force` (or `-Force`) parameter is defined in [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh) as a **compatibility flag** intended to preserve legacy command-line signatures. The inline documentation at line 5 explicitly states: ```bash # bash skills/scripts/case-guard.sh --case-root work/my-case --force # compatibility flag; never bypasses scope hard gates ``` When you append `--force` to your command, the script recognizes the flag but immediately proceeds through the standard validation pipeline. At lines 123–124, after completing its checks, the script outputs a confirmation reminder: ```bash CASE-GUARD: --force does not bypass scope hard gates. ``` This logging serves as an audit trail confirming that the operator attempted to use legacy syntax but that no security boundaries were circumvented. ## Authorization Gates Enforced Regardless of --force The [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) script implements **hard scope gates** that remain active even when the compatibility flag is supplied. Before any ACT (action) can proceed, the script validates the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) contract file and exits with status `2` if any requirement is missing. ### Required Scope Conditions The script mandates four specific conditions that cannot be overridden: - **`auth.status = granted`**: The authorization field in [`skills/ops/scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/ops/scope.md) must explicitly show granted status - **Network profile settings**: Valid network configurations must be declared - **Asset declarations**: Required assets must be properly listed in the scope - **`ready_for_act = true`**: The case directory must contain a positive readiness flag If any of these conditions evaluates to false, [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) terminates immediately with exit code `2`, printing specific diagnostics about which gates failed. ## Code Examples: Running With and Without --force The following commands demonstrate that both standard and legacy-compatible invocations undergo identical authorization verification: ```bash # Standard invocation bash skills/scripts/case-guard.sh --case-root work/my-case # Legacy-compatible invocation - still enforces all gates bash skills/scripts/case-guard.sh --case-root work/my-case --force ``` When scope requirements are incomplete, both commands produce identical failure output: ```bash $ bash skills/scripts/case-guard.sh --case-root work/my-case --force CASE-GUARD NOT READY: work/my-case - auth.status is not granted - ready_for_act is not true CASE-GUARD: --force does not bypass scope hard gates. Fix scope (or re-run case-init with --auth-granted --target-url ...). ``` Notice that the error message explicitly reminds the operator that `--force does not bypass scope hard gates`, reinforcing that the flag provides no privilege escalation. ## Architecture of the Scope Guard System Understanding the relationship between [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) and the broader reverse-skill ecosystem clarifies why authorization cannot be bypassed at the command line. ### Entry Point and Routing The **[`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh)** file serves as the primary routing entry point for all actions. This script eventually invokes [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) before executing any ACT, ensuring that scope validation occurs regardless of which high-level command initiated the request. ### Scope Initialization Authorization begins in **[`skills/scripts/case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-init.sh)**, which creates the initial [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file within the case directory. This file resides in **`skills/ops/`** alongside evidence contracts and role definitions. The [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) script validates these artifacts against the **hard scope gates** defined in the codebase. ### Global Rules Integration The **[`RULES.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/RULES.md)** file at the repository root contains global routing rules that rely on the same authorization checks performed by [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh). Because the entire reverse-skill framework routes through these validated gates, no single command-line flag can override the security model without modifying the underlying shell scripts themselves. ## Summary - The `--force` flag in [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh) is purely a **compatibility mechanism** for legacy command syntax, not a security bypass. - Authorization requires four specific conditions in [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md): `auth.status = granted`, network profiles, asset declarations, and `ready_for_act = true`. - Missing authorization causes immediate termination with **exit code 2**, regardless of whether `--force` was specified. - The reverse-skill architecture routes all actions through [`master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/master-route.sh) and [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh), ensuring consistent enforcement of hard scope gates. ## Frequently Asked Questions ### Can I skip authorization checks using --force in reverse-skill? No. The `--force` flag never bypasses authorization or scope validation. According to line 5 of [`skills/scripts/case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/case-guard.sh), the flag is explicitly documented as a "compatibility flag" that "never bypasses scope hard gates." The script will exit with status `2` if `auth.status` is not set to `granted` in the [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md) file. ### What exit code does case-guard.sh return when authorization fails? The script returns **exit code 2** whenever hard scope gates detect missing authorization, incomplete network profiles, or unready case states. This behavior is consistent whether or not the `--force` flag was included in the command invocation. ### How do I properly grant authorization for a case in reverse-skill? You must use [`case-init.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-init.sh) with the appropriate grant flags to set up a valid [`scope.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/scope.md). The error message from [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) suggests re-running with `--auth-granted` and `--target-url` parameters. This updates the `auth.status` field to `granted` and establishes the required network profile settings in the `skills/ops/` directory. ### Does the master-route.sh script also respect the scope gates? Yes. The [`skills/scripts/master-route.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/master-route.sh) entry point invokes [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) before executing any ACT (action). Since all routing eventually passes through this validation layer, the authorization requirements enforced by [`case-guard.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/case-guard.sh) apply universally across the reverse-skill framework, regardless of which script initiated the operation.