I don't see anything malicious or unusually risky in this tool. herdr is a popular open-source Rust project (about 45k stars, Apache-2.0). Installing it is about as risky as any developer tool installed from a vendor's script, as long as you trust the herdr.dev maintainers. I checked the installer, the update code, the local socket and the agent integrations at that commit. I did not audit the whole codebase, the plugins or the remote/SSH code.

**What looks fine**
- **Installer (`install.sh`):** It doesn't use sudo, it installs only to `~/.local/bin/herdr`, and it doesn't edit your shell startup files. It checks the binary against a SHA-256 hash before installing.
- **Network:** I found no tracking or data collection. It contacts only `herdr.dev/latest.json` (or `preview.json`) to check for updates, and `formulae.brew.sh` if you installed with Homebrew.
- **Updates:** At startup it only checks whether a new version exists. It downloads a new binary only when you run `herdr update`.
- **Local socket:** Agents and the client talk to herdr through files in `~/.config/herdr/`. The socket file is set to owner-only permissions (`0600`), and nothing listens on a network port.

**Real but modest risks**
1. **No signatures.** The installer and `herdr update` get the download link and its hash from the same file on herdr.dev. If herdr.dev or its release pipeline were compromised, an attacker could supply a bad binary with a matching hash. Homebrew (`brew install herdr`) gives you an independent check.
2. **Preview builds may skip verification.** On the `preview` update channel the hash is optional, so a preview build can install without any check. Stable builds require one.
3. **The socket is a powerful control channel by design.** No password or token is needed beyond the file permissions. Any program running as your user, including the AI agents inside herdr, can create panes, type into them and prompt other agents. That doesn't cross a security boundary, since those programs already run as you. It does make it easier for one compromised or prompt-injected agent to affect your other sessions.
4. **Agent integrations change other tools' settings.** For example, it adds a `SessionStart` hook to Claude Code's settings and adds blocks to the configs of OpenCode, Kimi and others. From what I read, it only adds its own hooks and doesn't change Claude's permissions. I couldn't confirm whether this happens automatically or only when you ask, so check `~/.claude/settings.json` after installing.
5. **Plugins and SSH remotes** are extra trust you'd be taking on: plugins are third-party code that runs on your machine, and remotes use your SSH access. Both are optional.
6. **Windows:** the PowerShell installer and updater turn off PowerShell's script-signing check (`-ExecutionPolicy Bypass`). That's common practice, but worth knowing.

**Recommendations:** Install with Homebrew, or download `install.sh`, read it, then run it. Stay on the stable channel. Treat herdr as a tool that can control every agent session you run in it.

Sources:
- [herdr repo at a200866](https://github.com/herdrdev/herdr/tree/a2008661cd4a89ff6df22bf4a6b472bd413018be)
- [install.sh](https://herdr.dev/install.sh)
- [src/update.rs](https://raw.githubusercontent.com/herdrdev/herdr/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/update.rs)
- [src/ipc.rs](https://raw.githubusercontent.com/herdrdev/herdr/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/ipc.rs)
- [src/server/socket_paths.rs](https://raw.githubusercontent.com/herdrdev/herdr/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/server/socket_paths.rs)
- [src/integration/claude_settings.rs](https://raw.githubusercontent.com/herdrdev/herdr/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/integration/claude_settings.rs)