The pattern of piping an arbitrary script to your shell? This should be an ordinary app bundle to drop into /Applications, or be distributed as an installer.

The readme even says so itself:

> A bad curl | sh, a sketchy npm install, or one of the AI agents now running in your editor with your full permissions.

And then, two paragraphs down, it suggests to do just that to install…