The Arch User Repository basically operates on the idea that "You can review what's being installed, but it is entirely up to your technical competence to decide if this is what you want or not" Word will inevitably get out if some oddball package is doing something fishy, but if you're trying to do something really obscure it is worth taking a close look at it (this is not a thing most ordinary people have the training and experience to do though).

It can be kinda sketchy, but it has a better record than some other package distribution systems.