function gitPullOrClone (url, outPath, opts, cb) {
  if (typeof opts === 'function') {
    cb = opts
    opts = {}
  }

  const depth = opts.depth == null ? 1 : opts.depth

  if (depth <= 0) {
    throw new RangeError('The "depth" option must be greater than 0')
  }

  fs.access(outPath, fs.R_OK | fs.W_OK, function (err) {
    if (err) {
      gitClone()
    } else {
      gitPull()
    }
  })

  function gitClone () {
    // --depth implies --single-branch
    const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
    const args = ['clone', flag, url, outPath]
    debug('git ' + args.join(' '))
    spawn('git', args, {}, function (err) {
      if (err) err.message += ' (git clone) (' + url + ')'
      cb(err)
    })
  }

  function gitPull () {
    const args = depth < Infinity ? ['pull', '--depth=' + depth] : ['pull']
    debug('git ' + args.join(' '))
    spawn('git', args, { cwd: outPath }, function (err) {
      if (err) err.message += ' (git pull) (' + url + ')'
      cb(err)
    })
  }
}
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.