Git hooks have always been sketchy as hell.

Can't stand the Mac specific shit my co-workers keep dumping in there.

Wouldn't untrusted git hooks mean that git verify-* are useless since you're already running untrusted code?

>Wait, I thought git hooks aren't pulled from remote.

You are correct. They are not. Other tools may auto-install them (I hate it), but git does not ever.

(Though not completely sure.)