Allowlist ignored: Shell hard-rejects VCS snapshot / gh PR open|merge with repo skill-guard deny text (even --help)

Support Bug Reports
, ,
1

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

On Cursor 3.15.6 (macOS), Agent Shell hard-rejects specific commands with a Japanese deny message that is copied from a project Claude Code hook (.claude/hooks/skill-guard.sh), even though:

  1. Run Mode is Allowlist (not Auto-review / no Sandbox)
  2. The Command Allowlist already includes the relevant git / gh entries
  3. Project has no Cursor hooks.json / beforeShellExecution wiring
  4. Claude hook bypass env var does not help (proves the Claude hook is not executing)
  5. Even … --help is rejected before the process starts

The deny messages match the three blocked verb patterns in that hook verbatim (snapshot subcommand / PR open / PR merge). This is not a sandbox failure and not an allowlist gap.

Earlier sessions (2026-07-24 … 2026-08-07) also saw the same hard-rejects under Auto-review, including wrong deny text (gh issue create / gh issue comment getting VCS snapshot deny text) and no effect from project .cursor/permissions.json allow_instructions. The 2026-08-10 measurement isolates Allowlist mode to show Allowlist itself cannot override the gate.

Steps to Reproduce

  1. Open a git repo that contains Claude Code skill-guard copy (Japanese deny strings for snapshot / PR open / PR merge) — example: https://github.com/q-o-n/gari_frontend
  2. Cursor Settings → Agents → Execution and Approvals:
    • Run Mode = Allowlist
    • Command Allowlist includes the usual git / gh entries (including the snapshot subcommand)
  3. In Agent chat, ask the agent to run (or let it run) any of:
    • git snapshot subcommand with --dry-run -m "x"
    • gh pr create --help
    • gh pr merge --help
  4. Observe immediate Shell Reject (no approval card).
  5. Optional: gh issue comment … whose HEREDOC body merely mentions those phrases is also Rejected (full argv / body scan).

Expected Behavior

  • Allowlisted commands run automatically in Allowlist mode
  • Or, if policy still wants review, show an approval card that can succeed
  • --help / dry-run should not be hard-blocked
  • Deny text should not require Claude Code skill-flag / bypass env vars
  • HEREDOC body text for unrelated commands (e.g. gh issue comment) should not trigger those denies
  • Project .cursor/permissions.json allow_instructions (when using Auto-review) should be honored or clearly documented as ignored

Actual:

  • Immediate Reject with skill-guard-like Japanese text
  • Allowlist entries ignored for these patterns; bypass env ignored
  • --help for gh pr create / gh pr merge also Rejected
  • gh issue comment Rejected when body only mentions banned phrases

Measurement: https://github.com/q-o-n/gari_frontend/issues/1106#issuecomment-5235599897

Operating System

MacOS

Version Information

IDE:
Version: 3.15.6
OS: macOS 26.5.2 (darwin 25.5.0), arm64

For AI issues: add Request ID with privacy disabled

Cursor Agent (Auto / default)

Does this stop you from using Cursor

Sometimes - I can sometimes use Cursor

6

Hey @GNK3215 - this isn’t Allowlist failing. Cursor is importing your project’s Claude Code skill-guard hooks, and a hook deny blocks Shell before Allowlist runs (Third Party Hooks).

Fix: Cursor Settings → Rules, Skills, Subagents → turn off Include Third-Party Plugins, Skills, and Other Configs. Or open Settings → Hooks, find the Claude Project entries, and adjust/remove that skill-guard config. A terminal bypass env var won’t reach Cursor’s hook process.

If it’s still rejecting after that, send a screenshot of Settings → Hooks.