> That `totallysafescript.sh` could at least be inside of the package manager scope. Most of the times someone already did it, and published it to AUR.

The AUR is still not as good as proper package management and shouldn't be considered a stable or reliable method of software distribution at scale.