You a free to inspect the yaml file which will be passed into the docker compose.

Also it is not as dramatic as it looks like as docker compose will just start containers. All the potentially malicious code will be run in containers.