nemoclaw-user-get-started
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs users to download and execute shell scripts directly by piping remote content to
bashorsh. These scripts originate from the vendor's official domain (nvidia.com) and a well-known service provider (ollama.com). - [COMMAND_EXECUTION]: Guidance includes commands for system-level configuration, such as using
sudofor Docker installation, adding users to thedockergroup, and utilizing theInvoke-WebRequestcommand in PowerShell with an-ExecutionPolicy Bypassflag to run a bootstrap script. - [EXTERNAL_DOWNLOADS]: Fetches installation assets and configuration scripts from the vendor's GitHub repository and official domains. These downloads are integral to the stated purpose of the skill as an installer.
- [CREDENTIALS_UNSAFE]: The documentation provides guidance on configuring API keys for various services (OpenAI, Anthropic, Google, etc.). It correctly recommends the use of environment variables and non-interactive setup for credential management rather than hardcoding secrets.
Audit Metadata