Please stop suggesting anyone curl install anything, especially if you're transmitting it without authenticating it's even coming from the right server...
You are absolutely right.
I'm assuming that people take a look in the script before they run the command line. It's common to see websites asking people to do that. But you have a point. I will think in a better way to help people to install the script. Any suggestion ? For now, I will change the URL to https with a verified certificate.