**Yes—there are meaningful risks, though I found no clear evidence of malware in the files I inspected at commit `a2008661`.** I would treat Herdr as a trusted terminal application with access to sensitive development work.

The main concerns are:

- **The install command doesn’t install this exact commit.** It executes a live script, which downloads the latest binary using `herdr.dev/latest.json`. SHA-256 verification is present, but the checksum comes from that same website; compromising it could allow an attacker to replace both the download and checksum. The inspected installer defaults to `~/.local/bin` and does not invoke `sudo`. [Installer source](https://github.com/herdrdev/herdr/blob/a2008661cd4a89ff6df22bf4a6b472bd413018be/distribution/install.sh)
- **Its control API is powerful.** Herdr intentionally lets agents control terminal panes and prompt other agents. On Unix, the API socket is restricted to owner access (`0600`), which is good, but processes running as your user share that boundary. Do not assume separate panes isolate untrusted agents. [API server](https://github.com/herdrdev/herdr/blob/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/api/server.rs)
- **Plugins execute native commands.** The inspected command runner launches programs directly, without adding a sandbox. Treat a plugin as another executable you are trusting with your account’s permissions. [Plugin command runner](https://github.com/herdrdev/herdr/blob/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/plugin_command.rs)
- **Some state persists, and background network checks exist.** Session metadata is saved locally; optional terminal-history persistence could retain secrets printed in panes. Background version and detection-manifest checks are enabled by default, while pane-history persistence is disabled. [Persistence](https://github.com/herdrdev/herdr/blob/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/persist.rs), [configuration defaults](https://github.com/herdrdev/herdr/blob/a2008661cd4a89ff6df22bf4a6b472bd413018be/src/main.rs)

**My recommendation:** first try it in a disposable VM or separate account without production credentials, SSH-agent access, or third-party plugins. For this specific revision, build from the pinned commit with locked dependencies rather than using the moving installer. That improves version control, but does not eliminate dependency or build-tool risks.

This was a targeted static review—not a complete audit, dependency vulnerability scan, or verification that published binaries match the source. I did not install or execute it.

Fixed but not yet released (awaiting review): Nothing.