  function gitClone () {
    // --depth implies --single-branch
    const flag = depth < Infinity ? '--depth=' + depth : '--single-branch'
    const args = ['clone', flag, url, outPath]
    debug('git ' + args.join(' '))
    spawn('git', args, {}, function (err) {
      if (err) err.message += ' (git clone) (' + url + ')'
      cb(err)
    })
  }
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.