anchor.diff:  
   The default bootstrap script will execute hooks from the agent configuration (global) and the repository (local). Running local hooks may be undesirable if you are building commits from untrusted sources (e.g. 3rd party pull requests).
   
  -Local hooks can be disabled by setting `BUILDKITE_NO_LOCAL_HOOKS=true` in the environment.
  +Local hooks can be disabled by setting [no-local-hooks](/agent/v3/configuration#no-local-hooks).
   
   If local hooks are disabled and one is in the checkout, the job will fail.
   
  
positive.code: 
  As plugins execute in the same way as local hooks, they can pose a potential security risk. If you're using third party plugins, you'll be executing the third party's code on your agent.
  
  You can disable plugins with the command line flag: `--no-plugins`.
  
  ## Disabling local hooks
  
  If you have configured your agent to do very specific things with global hooks (i.e. run commands within a Docker container or a chroot environment), you probably don't want them overridden with local ones. Disabling local hooks will also disable plugins.
  
  You can disable local hooks with the command line flag: `--no-local-hooks`.
  
  ## Strict checks using agent hooks
  
  
negative.code: 
  Once disabled your build steps will need to be checked into your repository as scripts, and the only way to pass arguments is via environment variables.
  
  Command line evaluation can be disabled by setting [`no-command-eval`](/agent/v3/configuration#no-command-eval):
  
  * Environment variable: `BUILDKITE_NO_COMMAND_EVAL=1`
  * Command line flag: `--no-command-eval`
  