Security

star runs git against user-supplied URLs and unpacks repository content onto your disk. Here is the discipline around both.

Arbitrary remotes

star use <url>#template and star repo add hand your URLs to git — invoked as an argv array, never through a shell, so injection via URLs is not possible. Protocol restrictions (protocol.allow and friends) are your git config’s business, not star’s; star adds no additional network surface beyond what your own git would do with the same URL.

Archive extraction is untrusted-input territory

git archive output is extracted with the same discipline as tar’s safe modes:

• no absolute member paths,
• no .. path components,
• symlinks may not escape the extraction root,
• devices and fifos are refused outright.

Symlinked templates

Symlinks inside a template are copied as symlinks; anything resolving outside the template root is skipped with a warning rather than followed.

Confirmation before writes into non-empty directories

star only ever adds files — but saying so is not the same as asking. Writing into a non-empty directory (.git counts) triggers an interactive confirmation, or demands --force when no TTY is attached.