I assume the cloned git repo includes arbitrary code that will be executed with the same security profile as a downloaded shell script.