hermes-onboarding

No clear malicious behavior is present in the supplied material. The content is legitimate-looking deployment documentation, but it includes high-impact operational instructions: root-level persistent services, an unpinned Docker image, unauthenticated CDP, --no-sandbox, and optional network exposure. Pin images, run the gateway unprivileged where possible, restrict ports to loopback or controlled networks, and protect CDP with strict firewall or SSH-tunnel controls.