You should publish the hash of the script, then the user should download it to disk, verify the script and then execute it. The same as would apply to any binary download - if a binary can be compromised so can a shell script.<p>Alternatively you can code review the script before executing it, which is a plus.