If you don't trust upstream, a PKGBUILD from AUR is the least of your problem.