anchor.diff:  
   Once disabled your build steps will need to be checked into your repository as scripts, and the only way to pass arguments is via environment variables.
   
  -To disable command line evaluation use one of the following settings:
  +Command line evaluation can be disabled by setting [`no-command-eval`](/agent/v3/configuration#no-command-eval):
   
   * Environment variable: `BUILDKITE_NO_COMMAND_EVAL=1`
   * Command line flag: `--no-command-eval`
  
positive.code: 
  The default bootstrap script will execute hooks from the agent configuration (global) and the repository (local). Running local hooks may be undesirable if you are building commits from untrusted sources (e.g. 3rd party pull requests).
  
  Local hooks can be disabled by setting `BUILDKITE_NO_LOCAL_HOOKS=true` in the environment.
  
  If local hooks are disabled and one is in the checkout, the job will fail.
  
  
negative.code: 
  If you choose to disable this functionality, you'll need to manually perform your first checkout, or ensure the SSH fingerprint of your source code host is already present on your build machine.
  
  Automatic ssh-keyscan can be disabled by setting [`no-ssh-keyscan`](/agent/v3/configuration#no-ssh-keyscan):
  
  * Environment variable: `BUILDKITE_NO_SSH_KEYSCAN=true`
  * Command line flag: `--no-ssh-keyscan`
  