A neat attack, but probably unrealistic in the context of those downloads being on github.
Its not just one script that you're curling and execing. That scripts curls and execs some other scripts. And those others. You're pretty much auditing a whole codebase at that point, for better or worse.