Review unfamiliar scripts before execution

1. Treat downloaded code as untrusted until you have checked its origin and purpose.

2. Confirm the official maintainer, license, expected dependencies and latest release notes.

3. Read scripts as text first; identify network downloads, filesystem writes and privilege requests.

4. When a trusted release publishes a checksum, verify the downloaded bytes against it.

5. Exercise: build a pre-run checklist and test it on a harmless script from your own repository.

Scope: Education and testing on owned or explicitly authorized systems only.