If the cask downloads directly from dropbox I would trust it. It's up to you who you feel comfortable trusting. If you have internal company stuff you don't want out keep it on a private intranet. This is the type of stuff Richard Stallman has talked about for years. It's a real problem but I'm afraid nobody listens.