中文導讀（編輯整理）
未見惡意行為；主要是安裝來源信任與強大的本機控制能力。提醒雜湊未簽署，以及選用外掛／SSH 的風險。
實際閱讀範圍：安裝程式、更新、本機 socket 與 agent 整合；未稽核外掛或遠端程式。
下載完整英文原文 · SHA-256 5546d4678e38cead688458ef3b8337fc36d7a36e544de3f4a3f5f0bf10e13913
完整英文原始回覆（未翻譯）
I don’t see anything malicious or unusually risky in this tool. herdr is a popular open-source Rust project (about 45k stars, Apache-2.0). Installing it is about as risky as any developer tool installed from a vendor’s script, as long as you trust the herdr.dev maintainers. I checked the installer, the update code, the local socket and the agent integrations at that commit. I did not audit the whole codebase, the plugins or the remote/SSH code.
What looks fine
- Installer (
install.sh): It doesn’t use sudo, it installs only to~/.local/bin/herdr, and it doesn’t edit your shell startup files. It checks the binary against a SHA-256 hash before installing. - Network: I found no tracking or data collection. It contacts only
herdr.dev/latest.json(orpreview.json) to check for updates, andformulae.brew.shif you installed with Homebrew. - Updates: At startup it only checks whether a new version exists. It downloads a new binary only when you run
herdr update. - Local socket: Agents and the client talk to herdr through files in
~/.config/herdr/. The socket file is set to owner-only permissions (0600), and nothing listens on a network port.
Real but modest risks
- No signatures. The installer and
herdr updateget the download link and its hash from the same file on herdr.dev. If herdr.dev or its release pipeline were compromised, an attacker could supply a bad binary with a matching hash. Homebrew (brew install herdr) gives you an independent check. - Preview builds may skip verification. On the
previewupdate channel the hash is optional, so a preview build can install without any check. Stable builds require one. - The socket is a powerful control channel by design. No password or token is needed beyond the file permissions. Any program running as your user, including the AI agents inside herdr, can create panes, type into them and prompt other agents. That doesn’t cross a security boundary, since those programs already run as you. It does make it easier for one compromised or prompt-injected agent to affect your other sessions.
- Agent integrations change other tools’ settings. For example, it adds a
SessionStarthook to Claude Code’s settings and adds blocks to the configs of OpenCode, Kimi and others. From what I read, it only adds its own hooks and doesn’t change Claude’s permissions. I couldn’t confirm whether this happens automatically or only when you ask, so check~/.claude/settings.jsonafter installing. - Plugins and SSH remotes are extra trust you’d be taking on: plugins are third-party code that runs on your machine, and remotes use your SSH access. Both are optional.
- Windows: the PowerShell installer and updater turn off PowerShell’s script-signing check (
-ExecutionPolicy Bypass). That’s common practice, but worth knowing.
Recommendations: Install with Homebrew, or download install.sh, read it, then run it. Stay on the stable channel. Treat herdr as a tool that can control every agent session you run in it.
Sources: