This isn’t a simple answer. There are tools specific to different operating systems like Windows or Linux that perform file integrity monitoring. Be aware that things like system or build tool updates can create a lot of false positives.
There are some things you can do around checking code but that will generally add a lot of management overhead. Are these scripts coming from untrusted sources or do you want to double check that internal developers aren’t doing anything bad?
One of the easiest things to do is network segmentation. Make sure the box is isolated in an environment where it can build properly but connections originating from this box can’t connect to other systems. This will help even if someone does manage to sneak something malicious in there is isn't a path for it to get out compromise other machines.