Policies
Block Files That Skip Git Hooks
Block Files That Skip Git Hooks: what it does, its label on each agent, what it misses, and examples.
Catalog policy block-hook-bypass-in-files, version 0.1.2, labelled blocks on Claude Code.
What it does
Friction, not a security boundary: flags lines added to hook launchers and scripts that switch git hooks off -- the hook-skip option on a git commit/push/merge/am/rebase/pull, core.hooksPath set by git config or GIT_CONFIG_*, the husky, lefthook and pre-commit off-switch variables, a pre-commit, lefthook or husky (v8 and older) uninstall -- in .husky/, .githooks/, lefthook, package.json, Makefile, justfile, .envrc, *.sh. Blocks. Misses: split lines, -n.
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Blocks | Blocks on an agent's file writes and at turn end |
| Cursor | Blocks | Blocks on an agent's file writes and at turn end |
| Codex | Blocks | Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| GitHub Copilot | Blocks | Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| Devin | Blocks | Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed) |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
Split lines, -n.
Examples from its eval suite
Refused: A package.json prepare script points core.hooksPath at a directory of its own.
Allowed: A hook script reads core.hooksPath to report where the hooks live.
More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.