Anything that your script runs has the same permissions or fewer than the script itself (ignoring anything that has the setuid/setgid flag, which none of cp/rm/mv/chmod should have), so using modules instead of `cp` etc will be fine.