You should always inspect a script before executing it. You can even pass it to AI and query the AI about it.
Even suggesting that for something like this in the readme is a red flag to me.
It's probably just a bad habit on the part of the author, but it may very well be intended to promote such unsafe practices with the intent to at least have the option to exploit it at some point later.
I’m not sure whether pressing the „fork” button and inspecting it in your local repository is “near impossible”.
There are many ways more competent/sane users who realize the danger can work around those.
My concern is that some percentage of users are likely to follow the method in the readme to the letter, without knowing or caring about the danger. Either the author knows this (if not-> incompetent, which is not likely), doesn't care (maybe it's mostly intended for black hack hacking).
Or it's actually a trap, where it's first presented as a useful tool, but where a phone home addon is injected at some point later, and able to collect massive numbers of keys before it's detected.