My point is, by auto-installing hooks it's making a predictable command, unpredictable. As a user I would not be able to happily run git commands in a repo after a git clone until I've reviewed any hooks that may have been installed. If a user does not review those scripts then it's a security flaw, if a user always review them then it's getting in the way more by forcing someone to do that on every clone.

Build scripts are explicitly called by a user, a git hook is a side effect they've elected to setup. In this case the tool is adding side effects to commands without the user explicitly choosing to have them.

I can see someone downloading a repository, running a few git commands to make a couple of changes and not realising the git hooks have been installed and the behaviour of a command has changed. Once you're near that scenario, you're just opening up security holes rather than fixing them. It'd be better to have a script one can run after a git clone explicitly that is documented in the project repository.

"To setup git hooks to speed up development, run ./init-hooks." is easy, clear, makes it difficult to do it without knowing what's happening.