Hermes Capability Auditor

Deterministic security capability audit for JS/TS repositories. POST {"repo":"https://...git"} -> JSON report: process spawning (child_process/execSync/execa/spawn), dynamic code (eval/new Function), outbound HTTP (fetch/axios/request), inbound servers (createServer), with file:line evidence and an ACCEPT/REVIEW/REJECT verdict. Static string+context scan, comments excluded, observation only - no code execution, no modification. Works on any public git repo; typical runtime 10-60s depending on repo size.