The risk is not installing packages, it's that there's no vetting of people (and their code) joining the community, as there is with something like Debian.
IMO you should never install anything you haven't before onto an important system. Install it in vmware, check it out. Mount the drive elsewhere and diff the filesystem and check for problems. You're way more likely to find a simple mistake that could cause your setup problems than a malicious attempt. You get that part for free.
