"make sure it's not doing bad things" is never going to happen. Just look at the XZ attack (which is written in C) or the "The International Obfuscated C Code Contest" [1].

Also you might want to read "Reflections on Trusting Trust" [2].

[1] https://www.ioccc.org/

[2] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...