When did you last trust a one-line install script?

curl ... | sh, npx some-mcp-server, a skill someone linked in a comment. One recent scan found hundreds of servers in the official MCP registry launching unpinned packages, and one MCP server shipped a run of clean releases before a later one quietly changed what its tools did.

What do you actually do before running one: read the script, pin the version, check a signature, run it in a container, or just trust the publisher? Be honest.

Full disclosure: w3bs ships a one-line installer too (curl -fsSL https://w3bs.org/install.sh | sh), so we will answer this ourselves in a reply, and you can tear it apart.