Do I understand correctly that the main workflow is "pick the first Github repo returned by the search, check that it is legit by clicking the link, then install the app from it"? It seems very easy to make a mistake and install a malicious fork.