I found a project offering an airdrop but required participants to download and install their mobile app. The app is newly made with only few hundreds download and I don't think I'll ever use it.
Is it too risky?
It not risky at all. You just install the app they required and you are good to go. This only means that the project that is airdroping has had their own apps for their tokens. So no worries my friend.