would you install such a app (without compiling from source)? I would not trust it to not come with "friends"

(but would love to verify and use)

On an isolated test device for this purpose, yes. But otherwise, I would decompile it to look at it.