Your agent ran git. So did the repo: auditing repositories that arrive as files

GitSpawn turns a repository's own git config into code execution the moment your coding agent runs its first background git status. Here is the audit to run before an agent opens any folder you did not clone.