Herdr

中文導讀（編輯整理）

終端控制、原生外掛與持久狀態有實質風險；安裝雜湊與下載來源處於相同信任邊界。

實際閱讀範圍：庫內安裝程式、API server、外掛執行、持久儲存與預設設定。

下載完整英文原文 · SHA-256 5d82c7a725a12dba1b009e2fbaaa37811926161ade0e5e393b5355fb7b446769

完整英文原始回覆（未翻譯）

Yes—there are meaningful risks, though I found no clear evidence of malware in the files I inspected at commit a2008661. I would treat Herdr as a trusted terminal application with access to sensitive development work.

The main concerns are:

• The install command doesn’t install this exact commit. It executes a live script, which downloads the latest binary using herdr.dev/latest.json. SHA-256 verification is present, but the checksum comes from that same website; compromising it could allow an attacker to replace both the download and checksum. The inspected installer defaults to ~/.local/bin and does not invoke sudo. Installer source
• Its control API is powerful. Herdr intentionally lets agents control terminal panes and prompt other agents. On Unix, the API socket is restricted to owner access (0600), which is good, but processes running as your user share that boundary. Do not assume separate panes isolate untrusted agents. API server
• Plugins execute native commands. The inspected command runner launches programs directly, without adding a sandbox. Treat a plugin as another executable you are trusting with your account’s permissions. Plugin command runner
• Some state persists, and background network checks exist. Session metadata is saved locally; optional terminal-history persistence could retain secrets printed in panes. Background version and detection-manifest checks are enabled by default, while pane-history persistence is disabled. Persistence, configuration defaults

My recommendation: first try it in a disposable VM or separate account without production credentials, SSH-agent access, or third-party plugins. For this specific revision, build from the pinned commit with locked dependencies rather than using the moving installer. That improves version control, but does not eliminate dependency or build-tool risks.

This was a targeted static review—not a complete audit, dependency vulnerability scan, or verification that published binaries match the source. I did not install or execute it.

Fixed but not yet released (awaiting review): Nothing.