The best way is to always inspect what you are importing. Like, for any VRC asset that should only contain clothing for your avis, there will (likely) never be a C# script or shader be found in the import window. Of course there may be other ways. As with any "free" download sites, bad actors will always be present to take advantage of people trusting the source without questioning