git clone safety

Git repo may have hooks. But those hooks are repo local and not cloned from origin repo when running git clone.

Submodules on other hand, are the sources of multiple CVEs that lead to possible malicious code execution.

So:

git clone

is OK.

But:

git clone --recurse-submodules

is … I'm not so sure.