← Back to the comparison

Independent review · Full response

Herdr

Herdr · Codex · General question

2026-10-22a2008661c ↗Public-web access only

Exact prompt

Is there a security risk in installing this tool?
Pinned repository link supplied with the question ↗

The text below is the agent’s complete original response, with its original language identified. The introduction is editorial, not part of the original output or an independently verified conclusion. No installation or attack testing was performed.

Editorial introduction

Meaningful risk from terminal control, native plugins and persisted state. Installer checksums share the download publisher’s trust boundary.

Reading scope: Committed installer, API server, plugin runner, persistence and configuration defaults.

Download the complete original English text · SHA-256 5d82c7a725a12dba1b009e2fbaaa37811926161ade0e5e393b5355fb7b446769

Complete original response

Yes—there are meaningful risks, though I found no clear evidence of malware in the files I inspected at commit a2008661. I would treat Herdr as a trusted terminal application with access to sensitive development work.

The main concerns are:

  • The install command doesn’t install this exact commit. It executes a live script, which downloads the latest binary using herdr.dev/latest.json. SHA-256 verification is present, but the checksum comes from that same website; compromising it could allow an attacker to replace both the download and checksum. The inspected installer defaults to ~/.local/bin and does not invoke sudo. Installer source
  • Its control API is powerful. Herdr intentionally lets agents control terminal panes and prompt other agents. On Unix, the API socket is restricted to owner access (0600), which is good, but processes running as your user share that boundary. Do not assume separate panes isolate untrusted agents. API server
  • Plugins execute native commands. The inspected command runner launches programs directly, without adding a sandbox. Treat a plugin as another executable you are trusting with your account’s permissions. Plugin command runner
  • Some state persists, and background network checks exist. Session metadata is saved locally; optional terminal-history persistence could retain secrets printed in panes. Background version and detection-manifest checks are enabled by default, while pane-history persistence is disabled. Persistence, configuration defaults

My recommendation: first try it in a disposable VM or separate account without production credentials, SSH-agent access, or third-party plugins. For this specific revision, build from the pinned commit with locked dependencies rather than using the moving installer. That improves version control, but does not eliminate dependency or build-tool risks.

This was a targeted static review—not a complete audit, dependency vulnerability scan, or verification that published binaries match the source. I did not install or execute it.

Fixed but not yet released (awaiting review): Nothing.

← Back to the comparison