I get a little bit of heartburn over running arbitrary scripts downloaded from internet websites.

The easiest alternative is to run "curl <blah>", download the script, take a peek at the source, and only THEN follow up with the sh.

I mean, you're probably going to see a bunch of "download and install" commands, so you don't get much reassurance if you're worried that one of THOSE might be compromised too. But that's a problem inherent to unsigned internet installer scripts. At least you've somewhat mitigated the possibility that it's dumping your private SSH key to a server somewhere or some other blatantly malicious command.

On the other hand, the script might also include appropriate SHA1 verification commands, or be setting up a repository in a package manager, in which case it's pretty reasonable to trust the script.