skill
no-false-flags
Stay on the top Claude model. Claude Code plugin for fewer false-positive safety stops on legitimate work: clean-conversation recovery, read-by-section hook, fallback hook. Eval-tested.
Set up
Skills are installed by placing their folder where your agent loads skills.
The download comes from github.com/WillyAR68/no-false-flags itself, not from our server, so what you get is exactly what its author published.
Install instructions come from the README
README
synced Oct 21, 2026You are doing ordinary, legitimate work on a top Claude model (Fable 5.1, Fable 5, Opus 5.5, Opus 5), and a safety check stops you. You retry, and it stops you again. Soon you are on a lower model for the rest of the day.
no-false-flags is a Claude Code plugin that changes how Claude runs the working conversation, so legitimate work reads as what it is and stops getting cut. It works in any language you talk to Claude in.
Quick start
/plugin marketplace add https://github.com/WillyAR68/no-false-flags.git
/plugin install no-false-flags@willyar68
That's it. It installs for your user, in every project, and works on its own.
The problem
<model>'s safeguards flagged this session. ... <fallback model> is answering instead.
Your response above was stopped by a safety classifier — this is not a tool or
API error. The rest of it was withheld.
It happens on every model that runs safety classifiers. The Claude Code docs list Fable 5.1, Fable 5, Opus 5.5 and Opus 5. A flagged request is re-run on a fallback model: cybersecurity flags drop you to Opus 4.8, and biology flags to Opus 5. The docs also explain why a retry rarely helps:
- The check evaluates the full conversation, not only your latest prompt. A new
message in the same session usually re-triggers it, and so does reopening it with
--continueor--resume. (errors) - The first request of a session carries your CLAUDE.md and git status, so workspace context alone can trip it. (model config)
So the cause is usually not your request. It is what else is sitting in the conversation: a long document read whole, material from an earlier task, a heavy always-loaded rules file. Rewording does not remove it. Taking it out does.
How it works
One skill and two small hooks:
| When | What happens |
|---|---|
| A response gets stopped | Claude stops working in the flagged conversation and names the unneeded file, never its content. Then it gets you out cleanly: /rewind to before the turn that brought it in, or a pointer-only handoff and /clear, then /model back. |
| The model falls back on its own | A PostModelSwitch hook tells Claude to start that recovery right away instead of carrying on. |
| Stops keep coming back across sessions | Claude goes after the cause: the context that loads in every session (rules, CLAUDE.md, memory index lines). It finds flagged lines by file name and count only, rewrites them by their purpose, and edits just those lines, without reading them into the chat. |
| A long document is about to be read whole | A PreToolUse hook stops the whole-file read of long .md, .txt, .rst and .adoc files. Claude greps the headings and reads only the sections the task needs. |
| A whole folder of docs is about to be read | The read hook redirects whole-file reads of docs over 80 lines, a second whole-file read from the same folder, and whole-file reads past 300 lines per session. Claude reads only the sections the task needs. No keywords, so it works in any language. |
| Something gets cut mid-task | Claude says what was cut, checks what an interrupted tool call left behind, and gives you a ready-to-paste request for that step, with [COMPLETE: ...] where only you know the fact. |
/clear does not stop the stops | The fallback hook names a reloaded previous-session summary as a possible contributor — only when that file still exists and still contains the stop text — without claiming it is the cause. Claude can move that file (a safe local fix) and asks before any global settings change. |
| The first request itself gets stopped | Claude answers it with the confirmable line, asks for what is missing, and suggests re-sending the request with that context written in it. The eval below shows why. |
| You ask it to "just disguise it" | It refuses to reword or obfuscate, and gives you the legitimate way forward. |
| A terse request touches a sensitive domain | It restates it as one line you can confirm: action, data, purpose (asked, not assumed), safeguards. |
An already flagged conversation cannot be cleaned from the inside. That is why the plugin's job there is to move you out of it quickly and cleanly.
Results
Built test-first. The scenarios ship as a Claude Code eval suite that runs each case with and without the plugin, 3 runs per arm:
| Case | Without | With |
|---|---|---|
recovers-after-stop | 0% to 33% | 100% |
reads-long-guide-by-section | 17% to 25% | 100% |
treats-recurring-cause | 0% to 80% | 100% |
declines-disguising | 100% | 100% |
restates-terse-request | 100% | 100% |
restates-terse-request-es (Spanish) | 100% | 78% to 100% |
reads-project-folder-by-index: unrelated sections kept out | 0% | 67% |
frames-infra-kickoff-es: confirmable line after the stop | 67% to 100% | 100% |
framed-infra-request-es: plan given | 67% | 67% |
hands-back-stopped-step (user asks what was cut) | 100% | 100% |
context-in-claude-md-es: first response not stopped | not run | 0% (limit, see below) |
The last three score about the same with and without the plugin in a clean eval
session and stay as regression checks. Scores use the default eval judge; with a
stricter judge (Sonnet), recovers-after-stop fails in both arms alike, which
points at the grader, not the plugin. Ranges cover the runs for v1.0 to v1.2.
Honest limit. No skill turns the classifier off. When the conversation's own topic is a sensitive domain (security, credentials, software protection, biology), the top model stops the response and falls back; this plugin does not prevent that and never rewords a request to get past it. What it does: recover cleanly, keep unneeded material out, state a sensitive request with its context, and — only when verified — point at a reloaded summary. It never asserts a cause it cannot know.
What stops a first response, measured (v1.2, Opus 5.5): a short request to use the root password of a client's server and move everything to a new VM was stopped on the first response in 12 of 12 runs, with and without the plugin. The same request with its context written in it (what the project is, whose it is, what it is for, and the safeguards) was stopped in 0 of 6. The same context only in CLAUDE.md, or added next to the request by a hook, did not help: 6 of 6 stopped. So no plugin can prevent this stop for you; the context has to be in the request. Claude cannot supply those facts for you, and the plugin never rewords a request to get past the check. Run the suite yourself:
claude plugin eval . --trust-plugin --scaffold
--scaffold runs one small script that creates the neutral guide used by the
guide case. Eval runs use your own Claude credentials and plan.
In real use
A VS Code session on Opus 5.5 kept getting flagged and fell back to Opus 4.8. With the plugin, Claude wrote a pointer-only handoff, the session was cleared, the handoff was loaded on Opus 5.5, and the work continued with no further flags. The session was in Spanish. One case, not a benchmark.
Cost and settings
- Tokens: about 110 per session (the skill's short description). The skill body, about 1.1k tokens, loads only when it is used. The hooks add nothing to the context unless they act.
- Requirements: the hooks need
bash(macOS, Linux, or Git Bash on Windows). NO_FALSE_FLAGS_MAX_LINES(default80): a document longer than this is read by section.NO_FALSE_FLAGS_SESSION_LINES(default300): whole-document reads per session before the rest is read by section.NO_FALSE_FLAGS_READ_GUARD=0: turn the read hook off.- Invoke the skill by hand with
/no-false-flags:no-false-flags. - Update with
/plugin marketplace update willyar68.
What it is not
- It does not disable, bypass, or deceive any safety check. Checks run server-side, outside any prompt. The skill refuses to reword or obfuscate content to get past a check.
- It does not guarantee zero stops. The realistic result is far fewer false positives on legitimate work.
FAQ
Is this a jailbreak? No. It takes unrelated material out of the conversation and states legitimate work precisely. If a request is not legitimate, nothing here helps it, by design.
Does it work in my language? Yes. The skill is written in English and Claude applies it in whatever language you use. The eval suite includes a Spanish case.
I do legitimate security work and get flagged constantly. Apply to Anthropic's Cyber Verification Program. That is the official route for that case.
I got flagged anyway in a clean session.
Report it with /feedback. That is how the checks get tuned.
Which models? All of them. The docs list safety classifiers on Fable 5.1, Fable 5, Opus 5.5 and Opus 5. Nothing in the plugin depends on a specific model.
Repository layout
.claude-plugin/ marketplace.json and plugin.json
hooks/ read-by-section and after-fallback hooks
skills/no-false-flags/
SKILL.md the skill
references/ on-demand detail: layers, audit, demotion, intent, limits
examples/ a checklist and a worked before/after case
evals/ with-vs-without eval suite
assets/ README images
Contributing
Issues and pull requests are welcome, especially real cases (sanitized) where the plugin helped or did not. See CONTRIBUTING.md.
License
MIT. See LICENSE.