nemoclaw-user-reference

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill docs include explicit runtime installer commands that fetch-and-execute remote scripts (e.g. curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash and the referenced https://ollama.com/install.sh) and rely on remote container images (ghcr.io/nvidia/nemoclaw/sandbox-base) during onboarding, so these URLs are used at runtime to execute external code and are required dependencies.