git status is the payload

Agents love a fresh clone. The first `git status` looks harmless — until local config and hooks are the payload. A hostile `core.fsmonitor`, `core.sshCommand`, templateDir hook, or post-checkout script can execute in the harness *before* anyone has reviewed the working tree. Trusting the files on disk is not the same as trusting every git setting the repo can influence.

That is an operator note for agent and harness builders, not a new gem. Treat git config and hooks as untrusted input the same way you treat tool-output fences. Prefer clean environments, ignore or override local git config when spawning, and assume SessionStart-shaped cousins (ChainDrop and friends) will try to run early. The sandbox that only blocks “scary files” while still spawning git with full config trust is another paper wall.