block-no-verify-hook

Name: block-no-verify-hook
Author: wshobson

4.1kinstalls4.1kforks

How to install block-no-verify-hook?

wshobson/agents/block-no-verify-hook

$npx -y skills add wshobson/agents --skill block-no-verify-hook

Installs into the current project.

Summary

Configure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.

Files · 1

View on GitHub

SKILL.md

1	# Block No-Verify Hook
2
3	PreToolUse hook configuration that intercepts and blocks bypass-flag usage before execution, ensuring AI agents cannot skip pre-commit hooks, GPG signing, or other git safety mechanisms.
4
5	## Overview
6
7	AI coding agents (Claude Code, Codex, etc.) can run shell commands with flags like `--no-verify` that bypass pre-commit hooks. This defeats the purpose of linting, formatting, testing, and security checks configured in pre-commit hooks. The block-no-verify hook adds a PreToolUse guard that rejects any tool call containing bypass flags before execution.
8
9	## Problem
10
11	When AI agents commit code, they may use bypass flags to avoid hook failures:
12
13	```bash
14	# These commands skip pre-commit hooks entirely
15	git commit --no-verify -m "quick fix"
16	git push --no-verify
17	git commit --no-gpg-sign -m "unsigned commit"
18	git merge --no-verify feature-branch
19	```
20
21	This allows:
22	- Unformatted code to enter the repository
23	- Linting errors to bypass checks
24	- Security scanning to be skipped
25	- Unsigned commits to bypass signing policies
26	- Test suites to be circumvented
27
28	## Solution
29
30	Add a `PreToolUse` hook to `.claude/settings.json` that inspects every Bash tool call and blocks commands containing bypass flags.
31
32	### Configuration
33
34	Add the following to your project's `.claude/settings.json`:
35
36	```json
37	{
38	"hooks": {
39	"PreToolUse": [
40	{
41	"matcher": "Bash",
42	"hook": {
43	"type": "command",
44	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
45	}
46	}
47	]
48	}
49	}
50	```
51
52	### How It Works
53
54	1. Matcher: The hook targets only `Bash` tool calls, so it does not interfere with other tools (Read, Edit, Grep, etc.).
55	2. Inspection: The `$TOOL_INPUT` environment variable contains the full command the agent is about to execute. The hook uses `printf` to safely pass input (avoiding `echo` pitfalls with special characters) and checks for `--no-verify` or `--no-gpg-sign` flags only when preceded by a `git` command.
56	3. Blocking: If a bypass flag is found in a git command, the hook exits with code 2 and prints an error message. Exit code 2 signals Claude Code to reject the tool call entirely.
57	4. Pass-through: If no bypass flag is found, the hook exits with code 0 and the command executes normally.
58
59	### Exit Codes
60
61	\| Code \| Meaning \|
62	\|------\|---------\|
63	\| 0 \| Allow the tool call to proceed \|
64	\| 1 \| Error (tool call still proceeds, warning shown) \|
65	\| 2 \| Block the tool call entirely \|
66
67	## Blocked Flags
68
69	\| Flag \| Purpose \| Why Blocked \|
70	\|------\|---------\|-------------\|
71	\| `--no-verify` \| Skips pre-commit and commit-msg hooks \| Bypasses linting, formatting, testing, security checks \|
72	\| `--no-gpg-sign` \| Skips GPG commit signing \| Bypasses commit signing policy \|
73
74	## Installation
75
76	### Per-Project Setup
77
78	Create or update `.claude/settings.json` in your project root:
79
80	```bash
81	mkdir -p .claude
82	cat > .claude/settings.json << 'EOF'
83	{
84	"hooks": {
85	"PreToolUse": [
86	{
87	"matcher": "Bash",
88	"hook": {
89	"type": "command",
90	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
91	}
92	}
93	]
94	}
95	}
96	EOF
97	```
98
99	### Global Setup
100
101	To enforce across all projects, add to `~/.claude/settings.json`:
102
103	```bash
104	mkdir -p ~/.claude
105	cat > ~/.claude/settings.json << 'EOF'
106	{
107	"hooks": {
108	"PreToolUse": [
109	{
110	"matcher": "Bash",
111	"hook": {
112	"type": "command",
113	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
114	}
115	}
116	]
117	}
118	}
119	EOF
120	```
121
122	## Verification
123
124	Test that the hook blocks bypass flags:
125
126	```bash
127	# This should be blocked by the hook:
128	git commit --no-verify -m "test"
129
130	# This should succeed normally:
131	git commit -m "test"
132	```
133
134	## Extending the Hook
135
136	### Adding More Blocked Flags
137
138	To block additional flags (e.g., `--force`), extend the grep pattern:
139
140	```json
141	{
142	"hooks": {
143	"PreToolUse": [
144	{
145	"matcher": "Bash",
146	"hook": {
147	"type": "command",
148	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign\|force-with-lease\|force)

People who liked this also viewed

6 picks

Type

block-no-verify-hook

4.1kinstalls4.1kforks

View on GitHub

How to install block-no-verify-hook?

wshobson/agents/block-no-verify-hook

$npx -y skills add wshobson/agents --skill block-no-verify-hook

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Block No-Verify Hook
2
3	PreToolUse hook configuration that intercepts and blocks bypass-flag usage before execution, ensuring AI agents cannot skip pre-commit hooks, GPG signing, or other git safety mechanisms.
4
5	## Overview
6
7	AI coding agents (Claude Code, Codex, etc.) can run shell commands with flags like `--no-verify` that bypass pre-commit hooks. This defeats the purpose of linting, formatting, testing, and security checks configured in pre-commit hooks. The block-no-verify hook adds a PreToolUse guard that rejects any tool call containing bypass flags before execution.
8
9	## Problem
10
11	When AI agents commit code, they may use bypass flags to avoid hook failures:
12
13	```bash
14	# These commands skip pre-commit hooks entirely
15	git commit --no-verify -m "quick fix"
16	git push --no-verify
17	git commit --no-gpg-sign -m "unsigned commit"
18	git merge --no-verify feature-branch
19	```
20
21	This allows:
22	- Unformatted code to enter the repository
23	- Linting errors to bypass checks
24	- Security scanning to be skipped
25	- Unsigned commits to bypass signing policies
26	- Test suites to be circumvented
27
28	## Solution
29
30	Add a `PreToolUse` hook to `.claude/settings.json` that inspects every Bash tool call and blocks commands containing bypass flags.
31
32	### Configuration
33
34	Add the following to your project's `.claude/settings.json`:
35
36	```json
37	{
38	"hooks": {
39	"PreToolUse": [
40	{
41	"matcher": "Bash",
42	"hook": {
43	"type": "command",
44	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
45	}
46	}
47	]
48	}
49	}
50	```
51
52	### How It Works
53
54	1. Matcher: The hook targets only `Bash` tool calls, so it does not interfere with other tools (Read, Edit, Grep, etc.).
55	2. Inspection: The `$TOOL_INPUT` environment variable contains the full command the agent is about to execute. The hook uses `printf` to safely pass input (avoiding `echo` pitfalls with special characters) and checks for `--no-verify` or `--no-gpg-sign` flags only when preceded by a `git` command.
56	3. Blocking: If a bypass flag is found in a git command, the hook exits with code 2 and prints an error message. Exit code 2 signals Claude Code to reject the tool call entirely.
57	4. Pass-through: If no bypass flag is found, the hook exits with code 0 and the command executes normally.
58
59	### Exit Codes
60
61	\| Code \| Meaning \|
62	\|------\|---------\|
63	\| 0 \| Allow the tool call to proceed \|
64	\| 1 \| Error (tool call still proceeds, warning shown) \|
65	\| 2 \| Block the tool call entirely \|
66
67	## Blocked Flags
68
69	\| Flag \| Purpose \| Why Blocked \|
70	\|------\|---------\|-------------\|
71	\| `--no-verify` \| Skips pre-commit and commit-msg hooks \| Bypasses linting, formatting, testing, security checks \|
72	\| `--no-gpg-sign` \| Skips GPG commit signing \| Bypasses commit signing policy \|
73
74	## Installation
75
76	### Per-Project Setup
77
78	Create or update `.claude/settings.json` in your project root:
79
80	```bash
81	mkdir -p .claude
82	cat > .claude/settings.json << 'EOF'
83	{
84	"hooks": {
85	"PreToolUse": [
86	{
87	"matcher": "Bash",
88	"hook": {
89	"type": "command",
90	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
91	}
92	}
93	]
94	}
95	}
96	EOF
97	```
98
99	### Global Setup
100
101	To enforce across all projects, add to `~/.claude/settings.json`:
102
103	```bash
104	mkdir -p ~/.claude
105	cat > ~/.claude/settings.json << 'EOF'
106	{
107	"hooks": {
108	"PreToolUse": [
109	{
110	"matcher": "Bash",
111	"hook": {
112	"type": "command",
113	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"
114	}
115	}
116	]
117	}
118	}
119	EOF
120	```
121
122	## Verification
123
124	Test that the hook blocks bypass flags:
125
126	```bash
127	# This should be blocked by the hook:
128	git commit --no-verify -m "test"
129
130	# This should succeed normally:
131	git commit -m "test"
132	```
133
134	## Extending the Hook
135
136	### Adding More Blocked Flags
137
138	To block additional flags (e.g., `--force`), extend the grep pattern:
139
140	```json
141	{
142	"hooks": {
143	"PreToolUse": [
144	{
145	"matcher": "Bash",
146	"hook": {
147	"type": "command",
148	"command": "if printf '%s' \"$TOOL_INPUT\" \| grep -qE '(^\|&&\|;\|\\\|)\\sgit\\s+.--(no-verify\|no-gpg-sign\|force-with-lease\|force)

People who liked this also viewed

6 picks

Type