Olivier Revollat [off-list ref] writes:
I was wondering : What if I had a "malicious" GIT repository who can
"inject" code via git hooks mechanism : someone clone my repo and
some malicious code is executed when a certain GIT hook is triggered
(for example on commit ("prepare-commit-msg' hook))
In that somebody else's clone, you will not have _your_ malicious
hook installed, unless that cloner explicitly does something stupid,
like copying that malicious hook.