The agent needs to look at a third-party repository, one that ships a post-checkout hook and an instruction file aimed at agents.
It calls git_clone_safe instead of raw git clone; the clone lands in a subdirectory with hooks disabled, LFS filters stripped, and size and file counts checked.
The result line reports path, file and byte counts, and warnings.
The agent reads the repository's README; the content comes back wrapped as untrusted data with a git-specific warning, so the embedded instructions stay data.
The hook never ran: the file it would have created does not exist.
Protagonist: git-safe.
Supporting: nu-bang for the proof.
Point: clone and read foreign code without letting it execute or speak as the user.
# git-safe demo
1. The agent needs to look at a third-party repository, one that ships a post-checkout hook and an instruction file aimed at agents.
2. It calls `git_clone_safe` instead of raw `git clone`; the clone lands in a subdirectory with hooks disabled, LFS filters stripped, and size and file counts checked.
3. The result line reports path, file and byte counts, and warnings.
4. The agent reads the repository's README; the content comes back wrapped as untrusted data with a git-specific warning, so the embedded instructions stay data.
5. The hook never ran: the file it would have created does not exist.
Protagonist: git-safe.
Supporting: nu-bang for the proof.
Point: clone and read foreign code without letting it execute or speak as the user.