From 9ce3ec0082a78e1148ca20f6b06f3a8c55c14005 Mon Sep 17 00:00:00 2001
From: jesse-merhi <79823012+jesse-merhi@users.noreply.github.com>
Date: Tue, 11 Aug 2026 14:19:48 +1000
Subject: [PATCH] fix(security): reconcile current install boundaries

---
 docs/tools/plugin.md                         | 1 +
 src/plugins/install-security-scan.runtime.ts | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/tools/plugin.md b/docs/tools/plugin.md
index e538e64d70ff..211a149302a8 100644
--- a/docs/tools/plugin.md
+++ b/docs/tools/plugin.md
@@ -160,6 +160,7 @@ no-op. Plugin
 `before_install` hooks run later, and only in OpenClaw processes where plugin
 hooks are loaded, so use `security.installPolicy` for operator-owned install
 decisions instead. The flag does not override a block or policy failure.
+It also does not bypass `before_install` hook blocks.
 
 See [Skills config](/tools/skills-config#operator-install-policy-securityinstallpolicy)
 for the shared `security.installPolicy` exec schema used by both skills and
diff --git a/src/plugins/install-security-scan.runtime.ts b/src/plugins/install-security-scan.runtime.ts
index 50436b57c20e..64bdccc47b07 100644
--- a/src/plugins/install-security-scan.runtime.ts
+++ b/src/plugins/install-security-scan.runtime.ts
@@ -1000,7 +1000,6 @@ export async function scanInstalledPackageDependencyTreeRuntime(params: {
   const runPolicy = () =>
     runOperatorInstallPolicy({
       config: params.config,
-      dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
       logger: params.logger,
       onInstallPolicyWarning: params.onInstallPolicyWarning,
       origin: { type: "plugin-dependency-tree" },