I assume the cloned git repo includes arbitrary code that will be executed with the same security profile as a downloaded shell script.

If you read the source of all the programs you run, more power to you. Most people don't.