Hacker News Reader

It's not executing untrusted code, it's calling git when you have a malicious version of git on your system

No, read the report. It will call an executable called git.exe in the untrusted repo.