hermes-delegation

No direct proof of embedded malware exists in the provided fragment because it is documentation rather than executable code. However, the described installation pattern executes downloaded remote scripts immediately (`curl|bash`, `PowerShell iex`, and run-and-delete CMD), which is a high-impact supply-chain risk if the remote artifacts are tampered with. The documentation also indicates broad execution capabilities (terminal command helper and plugin auto-discovery of executable components) and a documented permission bypass option, which can amplify impact. Review the real installer scripts and the CLI/plugin execution paths for integrity verification (signing/hash pinning), strict sandboxing/permission enforcement, and a secure plugin trust model before use.