You could prepare your script in a way that it only executes once everything is downloaded (big string then eval or smthg). If you would that and use https is there anything else to worry about? I mean I do prefer to view the script before executing it, but theoretically.