[brookst]

On windows I guess?

On Linux and MacOS you'd need to run ./git to execute a malicious binary in the cloned repo.