Skip to content
Get packs

Guide · Agent skill

How to use the Block No-Verify Hook agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The block-no-verify-hook skill adds a small guard to a Claude Code project that checks every shell command the agent tries to run. If a git commit or push uses --no-verify or --no-gpg-sign, the command is rejected before it runs, so your pre-commit checks still execute. This guide is for teams that already use pre-commit hooks for linting, formatting, testing or security checks. By the end you will know what the skill does, how to install it, and how to test that it works.

Block No-Verify Hookwshobson/agents · MIT

Quick start

  1. 1Download and unzip. Download the ZIP from this page and unzip it into ~/.claude/skills/ or your project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
  2. 2Open settings.json. Create or open .claude/settings.json in your project root, or ~/.claude/settings.json to apply it to all projects.
  3. 3Add the PreToolUse hook. Add the hooks block from SKILL.md with the matcher set to Bash and the command that exits with code 2 on bypass flags.
  4. 4Test with a commit. Run git commit --no-verify -m "test" to confirm it is blocked, then run git commit -m "test" to confirm normal commits work.
  5. 5Commit the settings file. Add .claude/settings.json to version control so teammates get the same guard.

What a skill is and what this one makes the agent do

An agent skill is a folder with a SKILL.md file that gives an AI agent instructions for a specific task. This skill configures a PreToolUse hook: a check that Claude Code runs before each tool call. It is set to watch Bash tool calls only, so Read, Edit and Grep are not affected.

When the agent tries a git command containing a bypass flag, the hook rejects the call and prints a message telling the agent to commit without bypass flags so that pre-commit hooks run.

  • Blocks --no-verify, which skips pre-commit and commit-msg hooks.
  • Blocks --no-gpg-sign, which skips GPG commit signing.
  • Also blocks shorter prefixes git accepts, such as --no-veri, and short option groups with n after commit, such as -n or -nm.

Install the block-no-verify-hook skill

Download the ZIP from this page and unzip it into one of these locations: ~/.claude/skills/ to make it available to your user account, or .claude/skills/ inside a project to share it with that project. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

The skill's only file is SKILL.md. The hook itself is configured in a settings.json file, and the SKILL.md contains the exact configuration to add.

  • Per-user: unzip into ~/.claude/skills/
  • Per-project: unzip into your project's .claude/skills/
  • Claude apps: Settings → Capabilities → Skills

Add the PreToolUse hook to settings.json

The skill's configuration goes in .claude/settings.json in your project root. For a single project, add it there. To enforce it across all projects, add the same block to ~/.claude/settings.json instead.

The hook matches only the Bash tool. Its command reads the tool call JSON from stdin and searches the command value with grep -E. If it finds a bypass flag in a git command, it prints a BLOCKED message to stderr and exits with code 2, which tells Claude Code to reject the call. If nothing is found, it exits with code 0 and the command runs.

  • Exit code 0: allow the tool call.
  • Exit code 1: error, the tool call still proceeds with a warning.
  • Exit code 2: block the tool call entirely.
{"hooks":{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","command":"if grep -qE '\"command\"[[:space:]]*:[[:space:]]*\"([^\"\\\\]|\\\\.)*(--no-(ver|g)|commit([^\"\\\\]|\\\\.)*([[:space:]]|\\\\[tn])-[a-zA-Z]*n)'; then echo 'BLOCKED: --no-verify and --no-gpg-sign flags are not allowed. Run the commit without bypass flags so that pre-commit hooks execute properly.' >&2; exit 2; fi"}]}]}}

Test that the hook blocks bypass flags

After setup, check the hook with a test commit. The bypass command should be blocked, and the normal commit should succeed.

Run this check in a test repository so you do not create unwanted commits.

  • Blocked as expected: git commit --no-verify -m "test"
  • Should succeed: git commit -m "test"
git commit --no-verify -m "test" git commit -m "test"

Know the limits before you rely on it

The hook checks text. It stops an agent that reaches for a bypass flag out of habit, but not one that is deliberately trying to get around it, for example by building the flag from pieces or running git -c core.hooksPath=/dev/null commit. It also only blocks bypass flags; it does not check the code itself.

A false match, such as a commit message that mentions a flag, will block the call. The skill treats this as the safe way to fail.

  • Not a hard security boundary.
  • Does not judge the quality of the code being committed.
  • Works only if your repository has pre-commit hooks configured.

Tips for a team setup

Commit .claude/settings.json to version control so every team member gets the hook. Mention it in your contributing guide so developers understand why bypass flags are rejected. The hook is most useful when your pre-commit hooks contain meaningful checks.

You can extend the pattern to other flags. The SKILL.md shows an example that also blocks git force options, and a way to combine the hook with another PreToolUse hook.

  • Commit the settings file so the whole team is covered.
  • Document the hook in onboarding material.
  • Pair it with real pre-commit checks.
  • Test after every setup change.

What people use it for

  • Stop an agent from committing unformatted code by blocking --no-verify when linting or formatting hooks are configured.
  • Keep unsigned commits out of a project with a commit signing policy by blocking --no-gpg-sign.
  • Make sure security scans and test-related pre-commit checks run on every agent commit.
  • Enforce the same guard across several projects by adding the configuration to ~/.claude/settings.json.

Frequently asked questions

Is the block-no-verify-hook skill free?

The skill is published under the MIT licence, as stated on its listing. Check the repository licence for the full terms before reusing it.

What do I need to use it?

You need Claude Code or another agent that supports PreToolUse hooks, a POSIX shell with grep that supports -E, and a git repository with pre-commit hooks configured. Without pre-commit hooks the guard adds setup without much benefit.

Does it work with tools other than Claude Code?

The skill targets Claude Code and any agent that supports PreToolUse hooks. The SKILL.md mentions Codex as an example of an agent that runs shell commands, but it does not describe how to set up the hook there.

Why does the hook block a normal commit message that mentions --no-verify?

The hook searches the text of the command, so a false match can block the call. The skill accepts this because failing safe is preferred to letting a bypass through.

Can an agent get around the hook?

Yes, if it deliberately tries. The hook checks text, so an agent that builds the flag from pieces or runs git -c core.hooksPath=/dev/null commit can get past it. Treat it as a guard against habits, not a security boundary.

Does the hook check whether my code is good?

No. It only blocks bypass flags. The checks themselves come from your pre-commit hooks, so those must be configured and meaningful.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if your team relies on pre-commit hooks for linting, formatting, testing or security checks and you want Claude Code to respect them. Skip it if your project has no pre-commit hooks, or if you need a hard security control that an agent cannot work around.

Download the skill