The mojo, cpan and pip bash scripts don't fail my test of "skimming over the source and looking for dangerous external commands like curl or rm" (good syntax highlighting is helpful here). They look like typical completion scripts. However, if your Linux distribution has a pip completion script in their repos, prefer that one.

The majority of software is not security audited.

It is an expensive process, that requires significant skill and training.

Best bet is to look for any obviously encoded blobs or urls. But a good malware developer should be able to hide their malicious code far better than that.

Auditing is nothing more than reading the code. Give it a read and make sure you understand everything it’s doing.

This is a great lesson on trust as well. I can tell you I did an audit and it all looks good but does that really have any value?