> git security oversight?

Executing downloaded code without prior review always is these days, regardless of the tool that does it.