Yup, there is a lot of prior art on how to get this wrong :(, and I dont know of any good solutions either. Curation and moderation are probably the best case, but arent bulletproof either.
I raised this not to kill OPs project, but to make sure they go into it eyes open. I personally would be very uncomfortable if my website was being abused to distribute malware, so they deserve to at least be aware of the risks.