docs: highlight untrusted git-arg interpolation as a warning callout

[EndBug]

Summary

• Turn the existing “do not interpolate untrusted data into git argument inputs” note into a GFM warning callout so it stands out in the README.

Test plan

• Confirm the warning renders as a GitHub alert on the README preview for this branch.

Made with Cursor

Summary by CodeRabbit

• Documentation
  • Added guidance warning against interpolating untrusted data into Git argument inputs.
  • Recommended using push: true with new_branch when working with dynamic branch names.
  • Preserved the existing guidance on quoted segments.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ada13c90-2d5a-49fe-b70f-647a9772e887

📥 Commits

Reviewing files that changed from the base of the PR and between fc1cf1d and 6f0ab66.

📒 Files selected for processing (1)

• README.md

---

📝 Walkthrough

Walkthrough

The README adds a warning against interpolating untrusted data into Git argument inputs. It recommends push: true with new_branch for dynamic branch names.

Changes

Input safety guidance

Layer / File(s)	Summary
Document unsafe Git inputs README.md	Adds warnings for untrusted interpolation in fetch, pull, push, tag, tag_push, and commit inputs. Recommends push: true with new_branch for dynamic branch names.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• EndBug/add-and-commit#760: Both PRs update README guidance about untrusted branch data in Git arguments and recommend new_branch.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/99d9c976

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}