AgentAlley

Skills · Security

Block No Verify Hook

Unverified●35/40

Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.

Originally by wshobson · MIT

Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor·UnknownWe have not crawled the repo tree, so we will not guess
Codex·UnknownWe have not crawled the repo tree, so we will not guess
Gemini CLI·UnknownThe spec defines no detection rule for Gemini
Copilot·UnknownWe have not crawled the repo tree, so we will not guess
npx agentalley add block-no-verify-hook

This command does not work yet — the CLI is still being built. Until then, use Raw in the reader below to take the file.

Who is stuck, and on what

Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.

The whole source

No sign-in, no blur, nothing truncated
block-no-verify-hook/SKILL.md194 lines6.2 KBRawView on GitHub
Frontmatter — 2 properties
nameblock-no-verify-hook
descriptionConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.
1---
2name: block-no-verify-hook
3description: Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.
4---A5 — No allowed-tools declared — no way to tell what this skill may touch
5 
6# Block No-Verify Hook
7 
8PreToolUse hook configuration that intercepts and blocks bypass-flag usage before execution, ensuring AI agents cannot skip pre-commit hooks, GPG signing, or other git safety mechanisms.
9 
10## Overview
11 
12AI coding agents (Claude Code, Codex, etc.) can run shell commands with flags like `--no-verify` that bypass pre-commit hooks. This defeats the purpose of linting, formatting, testing, and security checks configured in pre-commit hooks. The block-no-verify hook adds a PreToolUse guard that rejects any tool call containing bypass flags before execution.
13 
14## Problem
15 
16When AI agents commit code, they may use bypass flags to avoid hook failures:
17 
18```bash
19# These commands skip pre-commit hooks entirely
20git commit --no-verify -m "quick fix"
21git push --no-verify
22git commit --no-gpg-sign -m "unsigned commit"
23git merge --no-verify feature-branch
24```
25 
26This allows:
27- Unformatted code to enter the repository
28- Linting errors to bypass checks
29- Security scanning to be skipped
30- Unsigned commits to bypass signing policies
31- Test suites to be circumvented
32 
33## Solution
34 
35Add a `PreToolUse` hook to `.claude/settings.json` that inspects every Bash tool call and blocks commands containing bypass flags.
36 
37### Configuration
38 
39Add the following to your project's `.claude/settings.json`:
40 
41```json
42{
43 "hooks": {
44 "PreToolUse": [
45 {
46 "matcher": "Bash",
47 "hook": {
48 "type": "command",
49 "command": "if printf '%s' \"$TOOL_INPUT\" | grep -qE '(^|&&|;|\\|)\\s*git\\s+.*--(no-verify|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
50 }
51 }
52 ]
53 }
54}
55```
56 
57### How It Works
58 
591. **Matcher**: The hook targets only `Bash` tool calls, so it does not interfere with other tools (Read, Edit, Grep, etc.).
602. **Inspection**: The `$TOOL_INPUT` environment variable contains the full command the agent is about to execute. The hook uses `printf` to safely pass input (avoiding `echo` pitfalls with special characters) and checks for `--no-verify` or `--no-gpg-sign` flags only when preceded by a `git` command.
613. **Blocking**: If a bypass flag is found in a git command, the hook exits with code 2 and prints an error message. Exit code 2 signals Claude Code to reject the tool call entirely.
624. **Pass-through**: If no bypass flag is found, the hook exits with code 0 and the command executes normally.
63 
64### Exit Codes
65 
66| Code | Meaning |
67|------|---------|
68| 0 | Allow the tool call to proceed |
69| 1 | Error (tool call still proceeds, warning shown) |
70| 2 | Block the tool call entirely |
71 
72## Blocked Flags
73 
74| Flag | Purpose | Why Blocked |
75|------|---------|-------------|
76| `--no-verify` | Skips pre-commit and commit-msg hooks | Bypasses linting, formatting, testing, security checks |
77| `--no-gpg-sign` | Skips GPG commit signing | Bypasses commit signing policy |
78 
79## Installation
80 
81### Per-Project Setup
82 
83Create or update `.claude/settings.json` in your project root:
84 
85```bash
86mkdir -p .claude
87cat > .claude/settings.json << 'EOF'
88{
89 "hooks": {
90 "PreToolUse": [
91 {
92 "matcher": "Bash",
93 "hook": {
94 "type": "command",
95 "command": "if printf '%s' \"$TOOL_INPUT\" | grep -qE '(^|&&|;|\\|)\\s*git\\s+.*--(no-verify|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
96 }
97 }
98 ]
99 }
100}
101EOF
102```
103 
104### Global Setup
105 
106To enforce across all projects, add to `~/.claude/settings.json`:
107 
108```bash
109mkdir -p ~/.claude
110cat > ~/.claude/settings.json << 'EOF'
111{
112 "hooks": {
113 "PreToolUse": [
114 {
115 "matcher": "Bash",
116 "hook": {
117 "type": "command",
118 "command": "if printf '%s' \"$TOOL_INPUT\" | grep -qE '(^|&&|;|\\|)\\s*git\\s+.*--(no-verify|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
119 }
120 }
121 ]
122 }
123}
124EOF
125```
126 
127## Verification
128 
129Test that the hook blocks bypass flags:
130 
131```bash
132# This should be blocked by the hook:
133git commit --no-verify -m "test"
134 
135# This should succeed normally:
136git commit -m "test"
137```
138 
139## Extending the Hook
140 
141### Adding More Blocked Flags
142 
143To block additional flags (e.g., `--force`), extend the grep pattern:
144 
145```json
146{
147 "hooks": {
148 "PreToolUse": [
149 {
150 "matcher": "Bash",
151 "hook": {
152 "type": "command",
153 "command": "if printf '%s' \"$TOOL_INPUT\" | grep -qE '(^|&&|;|\\|)\\s*git\\s+.*--(no-verify|no-gpg-sign|force-with-lease|force)'; then echo 'BLOCKED: Bypass flags are not allowed.' >&2; exit 2; fi"
154 }
155 }
156 ]
157 }
158}
159```
160 
161### Combining with Other Hooks
162 
163The block-no-verify hook works alongside other PreToolUse hooks:
164 
165```json
166{
167 "hooks": {
168 "PreToolUse": [
169 {
170 "matcher": "Bash",
171 "hook": {
172 "type": "command",
173 "command": "if printf '%s' \"$TOOL_INPUT\" | grep -qE '(^|&&|;|\\|)\\s*git\\s+.*--(no-verify|no-gpg-sign)'; then echo 'BLOCKED: Bypass flags not allowed.' >&2; exit 2; fi"
174 }
175 },
176 {
177 "matcher": "Bash",
178 "hook": {
179 "type": "command",
180 "command": "if printf '%s' \"$TOOL_INPUT\" | grep -qE 'rm\\s+-rf\\s+/'; then echo 'BLOCKED: Dangerous rm command.' >&2; exit 2; fi"
181 }
182 }
183 ]
184 }
185}
186```
187 
188## Best Practices
189 
1901. **Commit the settings file** -- Add `.claude/settings.json` to version control so all team members benefit from the hook.
1912. **Document in onboarding** -- Mention the hook in your project's contributing guide so developers understand why bypass flags are blocked.
1923. **Pair with pre-commit hooks** -- The block-no-verify hook ensures pre-commit hooks run; make sure you have meaningful pre-commit hooks configured.
1934. **Test after setup** -- Verify the hook works by intentionally triggering it in a test commit.
194 

Reviews

Installed this one?Write the first review and take the Trailblazer badge.

Reviews only open after a real install, so this is empty — and we leave it empty rather than invent one.

Alternatives

Also in Security
Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.Security · MIT◐····●32/40Binary Analysis PatternsMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.Security · MIT◐◐◐◐◐●31/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.Security · MIT◐◐◐◐◐●30/40Protocol Reverse EngineeringMaster network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.Security · MIT◐····●30/40