building-inferencesh-apps

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The setup instructions pipe a remote install script from fnm.vercel.app into a shell, and that script is executed, but the URL sits on a generic hosting alias rather than a clearly first-party fnm domain, so provenance is only reputable-unofficial, giving medium under recall-first; the other fetches (astral.sh, nvm's pinned GitHub tag, and the vendor's own cli.inference.sh) are strong or official.