3 ms·

If that's your threat model (untrusted script = owned) then don't even bother creating a user account. Just run as root.