nemoclaw-user-get-started

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching and executing remote installer scripts at runtime — notably curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash (and the Windows bootstrap which downloads-and-runs https://raw.githubusercontent.com/NVIDIA/NemoClaw/main/scripts/bootstrap-windows.ps1, plus an optional curl -fsSL https://ollama.com/install.sh | sh) — meaning remote code is fetched and executed and can directly control the agent onboarding/setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The quickstart explicitly instructs running a remote installer (curl | bash) that requests sudo to install Docker, start system services, and modify user group membership (e.g., adding your user to the docker group), which changes host system state and requires elevated privileges.