It's bad, but no different than installing a package supplied by a third party, or using a third-party installer, in terms of what authority you're granting, bo

It's bad, but no different than installing a package supplied by a third party, or using a third-party installer, in terms of what authority you're granting, both of which are fairly commonplace. Obviously the eventual goal is to get something vetted and blessed into a package management system, but that's probably not a reasonable expectation for a brand new project.