Executing the hooks means I trust the template source with anything reachable from my user account – hopefully everyone using templates with hooks does a review beforehand. 🙈

I think there should be a --hooks=abort|skip|ask|trusted option that defaults to ask – many times, users won't know the difference because templates have no hooks, but it will have their backs when it counts (becoming aware they're about to execute abitrary code).