diff --git a/tests/presets.test.js b/tests/presets.test.js
index 04b0d969..8f88e985 100644
--- a/tests/presets.test.js
+++ b/tests/presets.test.js
@@ -16,6 +16,10 @@ catch {
   let { HEAD_REF: branch, REPO: repo } = process.env
   branch = branch || "presets"
   repo = repo || "lowlighter/metrics"
+  if (!/^[/-\w\d]+$/.test(branch))
+    throw new Error(`invalid branch: ${branch}`)
+  if (!/^[-\w\d]+\/[-\w\d]+$/.test(repo))
+    throw new Error(`invalid repo: ${repo}`)
   console.log(`cloning: ${repo}@${branch}`)
   processes.execSync(`git clone https://github.com/${repo}.git ${__presets} --branch ${branch} --single-branch`)
 }