Arbitrary file write via git_show option injection

Argument injection in the git_show tool in Hmbown CodeWhale before 0.8.64 allows attackers to overwrite files via a crafted rev value. The tool appends the model-supplied rev string to the git show argument vector without semantic validation or an end-of-options separator, so option-shaped input such as --output=/path is parsed by Git as a flag and redirects output into an attacker-chosen file. Exploitation requires a malicious repository and prompt injection to induce an auto-approved tool call, after which files writable by the invoking user, including shell or SSH configuration files, can be clobbered without a confirmation prompt.