> If you have YARD installed, and you install this gem, then YARD will load and run whatever is in ./script.rb from inside the gem.

How is that not a security issue in of itself?