I’d love to be surprised, but I think there isn’t any way to evaluate for vulnerabilities other than read all the code (fairly carefully). I don’t think the ecosystem is set up to make it easy.
You probably instead should use a throwaway computer (or VM if you trust them), and not do anything personal on that computer, and then burn it.