sounds bad, but as I said, it is bad anticheat design. good anticheat should recognize cheats no matter what the client is. I also said that I'm not able to do that, so I appreciate what I have (so you don't think that I came here and pounce on rich and his programming abilities/disabilities).
Triggers are implemented in the next R1Q2 release, however cl_health and other "stat" access is not planned.
than maybe it's possible to change q2 code this way:
set VARIABLE %h <- under variable VARIABLE we put the value returned by %h, not %h itself (current q2 behaviour). That would be expected behavoiur for most of the people, but I dont know how it looks from the programmer point of view.