Always staple creds

You want them for personals anyway.
Add a confirmation prompt

It's proper, even though the script isn't untrusted.