please stop piping into bash or sh. force people to use the editor, read the install script, and tell them how to run it

"curl | sh" certainly feels wrong, but in the end, even if you download and read the script before running commands, let's be real: you are going to run a binary that you didn't inspect.

Not saying you shouldn't check your scripts, I usually do, I like to know where the files are going in case the installer messes up, but the risks tend to be overstated compared to running the executable itself.

What if this project offered binaries from GitHub releases instead? How do you read those?

It's more realistic to decide if you trust the source, GitHub user yamafaktory in this case. Then you can ensure that your method of download uses TLS.