fix: prevent --force from overriding dangerous verdict in should_allow_install
The docstring states --force should never override dangerous verdicts, but the condition `if result.verdict == "dangerous" and not force` allowed force=True to skip the early return. Execution then fell through to `if force: return True`, bypassing the policy block. Removed `and not force` so dangerous skills are always blocked regardless of the --force flag.
This commit is contained in:
@@ -650,7 +650,7 @@ def should_allow_install(result: ScanResult, force: bool = False) -> Tuple[bool,
|
||||
Returns:
|
||||
(allowed, reason) tuple
|
||||
"""
|
||||
if result.verdict == "dangerous" and not force:
|
||||
if result.verdict == "dangerous":
|
||||
return False, f"Scan verdict is DANGEROUS ({len(result.findings)} findings). Blocked."
|
||||
|
||||
policy = INSTALL_POLICY.get(result.trust_level, INSTALL_POLICY["community"])
|
||||
|
||||
Reference in New Issue
Block a user