nemo-fabric-integrate

SUSPICIOUS. The core NeMo Fabric SDK guidance is internally consistent and mostly benign documentation, with official same-org package installs and proportionate credential use. The main issue is the Hermes integration path: it introduces a third-party, raw-script install chain outside NVIDIA’s normal package boundary, which raises medium-high supply-chain risk even though it may be operationally required. No clear credential harvesting, hidden exfiltration, or malicious behavior is evident in the skill itself.