Does the -Force Flag Bypass Authorization in Reverse-Skill?

The -Force/--force flag in reverse-skill does not bypass authorization; it is strictly a compatibility flag for legacy command-line signatures that preserves syntax while maintaining all hard scope gate checks.

If you are working with the zhaoxuya520/reverse-skill repository and wondering whether the --force option grants elevated privileges or skips security validations, the answer is definitively no. According to the source code in skills/scripts/case-guard.sh, this flag exists solely to maintain backward compatibility with legacy command patterns, but the script enforces the same rigorous authorization checks regardless of whether the flag is present.

What the --force Flag Actually Does in case-guard.sh

The --force (or -Force) parameter is defined in skills/scripts/case-guard.sh as a compatibility flag intended to preserve legacy command-line signatures. The inline documentation at line 5 explicitly states:

# bash skills/scripts/case-guard.sh --case-root work/my-case --force  # compatibility flag; never bypasses scope hard gates

When you append --force to your command, the script recognizes the flag but immediately proceeds through the standard validation pipeline. At lines 123–124, after completing its checks, the script outputs a confirmation reminder:

CASE-GUARD: --force does not bypass scope hard gates.

This logging serves as an audit trail confirming that the operator attempted to use legacy syntax but that no security boundaries were circumvented.

Authorization Gates Enforced Regardless of --force

The case-guard.sh script implements hard scope gates that remain active even when the compatibility flag is supplied. Before any ACT (action) can proceed, the script validates the scope.md contract file and exits with status 2 if any requirement is missing.

Required Scope Conditions

The script mandates four specific conditions that cannot be overridden:

• auth.status = granted: The authorization field in skills/ops/scope.md must explicitly show granted status
• Network profile settings: Valid network configurations must be declared
• Asset declarations: Required assets must be properly listed in the scope
• ready_for_act = true: The case directory must contain a positive readiness flag

If any of these conditions evaluates to false, case-guard.sh terminates immediately with exit code 2, printing specific diagnostics about which gates failed.

Code Examples: Running With and Without --force

The following commands demonstrate that both standard and legacy-compatible invocations undergo identical authorization verification:

# Standard invocation

bash skills/scripts/case-guard.sh --case-root work/my-case

# Legacy-compatible invocation - still enforces all gates

bash skills/scripts/case-guard.sh --case-root work/my-case --force

When scope requirements are incomplete, both commands produce identical failure output:

$ bash skills/scripts/case-guard.sh --case-root work/my-case --force
CASE-GUARD NOT READY: work/my-case
 - auth.status is not granted
 - ready_for_act is not true
CASE-GUARD: --force does not bypass scope hard gates.
Fix scope (or re-run case-init with --auth-granted --target-url ...).

Notice that the error message explicitly reminds the operator that --force does not bypass scope hard gates, reinforcing that the flag provides no privilege escalation.

Architecture of the Scope Guard System

Understanding the relationship between case-guard.sh and the broader reverse-skill ecosystem clarifies why authorization cannot be bypassed at the command line.

Entry Point and Routing

The skills/scripts/master-route.sh file serves as the primary routing entry point for all actions. This script eventually invokes case-guard.sh before executing any ACT, ensuring that scope validation occurs regardless of which high-level command initiated the request.

Scope Initialization

Authorization begins in skills/scripts/case-init.sh, which creates the initial scope.md file within the case directory. This file resides in skills/ops/ alongside evidence contracts and role definitions. The case-guard.sh script validates these artifacts against the hard scope gates defined in the codebase.

Global Rules Integration

The RULES.md file at the repository root contains global routing rules that rely on the same authorization checks performed by case-guard.sh. Because the entire reverse-skill framework routes through these validated gates, no single command-line flag can override the security model without modifying the underlying shell scripts themselves.

Summary

• The --force flag in skills/scripts/case-guard.sh is purely a compatibility mechanism for legacy command syntax, not a security bypass.
• Authorization requires four specific conditions in scope.md: auth.status = granted, network profiles, asset declarations, and ready_for_act = true.
• Missing authorization causes immediate termination with exit code 2, regardless of whether --force was specified.
• The reverse-skill architecture routes all actions through master-route.sh and case-guard.sh, ensuring consistent enforcement of hard scope gates.

Frequently Asked Questions

Can I skip authorization checks using --force in reverse-skill?

No. The --force flag never bypasses authorization or scope validation. According to line 5 of skills/scripts/case-guard.sh, the flag is explicitly documented as a "compatibility flag" that "never bypasses scope hard gates." The script will exit with status 2 if auth.status is not set to granted in the scope.md file.

What exit code does case-guard.sh return when authorization fails?

The script returns exit code 2 whenever hard scope gates detect missing authorization, incomplete network profiles, or unready case states. This behavior is consistent whether or not the --force flag was included in the command invocation.

How do I properly grant authorization for a case in reverse-skill?

You must use case-init.sh with the appropriate grant flags to set up a valid scope.md. The error message from case-guard.sh suggests re-running with --auth-granted and --target-url parameters. This updates the auth.status field to granted and establishes the required network profile settings in the skills/ops/ directory.

Does the master-route.sh script also respect the scope gates?

Yes. The skills/scripts/master-route.sh entry point invokes case-guard.sh before executing any ACT (action). Since all routing eventually passes through this validation layer, the authorization requirements enforced by case-guard.sh apply universally across the reverse-skill framework, regardless of which script initiated the operation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}