← 回到四專案比較

獨立審查 · 完整回覆

Herdr

Herdr · Codex · 讀取安全程式碼

2026-10-22a2008661c ↗僅讀公開網路

確切題目

Is there a security risk in installing this tool? Read the security-related code in this repository and understand its encryption and data transmission mechanisms before answering. If a mechanism cannot be verified from the accessible code, say so.
題目附帶的固定版本連結 ↗

下方完整保留 agent 原始回覆，原文語言有明確標示。中文導讀是編輯整理，不是原文，也不是驗證結論。審查沒有執行安裝或攻擊測試。

中文導讀（編輯整理）

確認 SSH 傳輸與作業系統保護的本機 socket；持久狀態是可讀 JSON，未找到獨立發布者驗簽。

實際閱讀範圍：安裝、持久儲存、SSH attach、Unix／Windows API 防護、更新與外掛路徑。

下載完整英文原文 · SHA-256 1cefd2c2e38306df79d4e3bea8f2101877235acfa6d871711d8e5906cbc80b8f

完整英文原始回覆（未翻譯）

Yes—there are meaningful security risks, although I found no evidence of intentional data theft in the code paths I inspected. I would treat Herdr as a trusted terminal controller with access to sensitive session content, rather than as an isolated utility.

I reviewed source files pinned to commit a2008661cd4a89ff6df22bf4a6b472bd413018be. This was a static review through accessible GitHub source; this session had no filesystem-reading or shell tool, so I could not inspect the local checkout, run tests, or capture actual network traffic.

The main findings are:

  1. Installation trusts the website and its release manifest.
    The Unix installer downloads https://herdr.dev/latest.json, obtains a binary URL and SHA-256 checksum, verifies the download, and installs it into ~/.local/bin by default. It does not request root privileges. However, the checksum comes from the same manifest that selects the binary: an attacker controlling that manifest could replace both. I found no independent publisher-signature verification in this installer. Also, the documented curl … | sh command executes the live website’s script, which is not pinned to the reviewed commit. Installer source

  2. Saved session data is not encrypted at rest.
    Persistence serializes directly to JSON and writes those bytes to disk. Saved fields include working directories, launch arguments, agent session references, and resume arguments. Optional history contains ANSI terminal content. Consequently, secrets displayed in saved history—or passed through saved arguments—can persist in readable files. The writer does not explicitly apply owner-only file permissions; protection depends on the surrounding directory permissions, OS defaults, and umask. Persistence writer, saved fields

  3. Remote terminal encryption is delegated to SSH.
    Herdr launches the system ssh executable and carries its remote bridge through SSH command input/output. I found no separate application-layer encryption in that transport. Saved/noninteractive connections explicitly use StrictHostKeyChecking=yes; ordinary interactive connections depend more on SSH configuration and normal SSH behavior. I cannot verify the actual cipher, key exchange, private-key protection, or effective host configuration from this repository—those depend on the installed SSH implementation and machine configuration. SSH transport and options

  4. The local API relies on OS access controls, not encrypted or token-authenticated requests.
    The inspected API uses local sockets, with Unix socket permissions set to 0600. Windows uses a user-specific named-pipe security descriptor and, by default, an integrity restriction for elevated servers. The request handler parses JSON without an application login/token handshake. These are useful protections against other accounts, but ordinary processes running as your account remain within the trust boundary. Do not expose or forward this socket to untrusted users. API server, Windows controls

  5. Background network requests exist.
    Update checks fetch hosted manifests; detection updates fetch a catalog from herdr.dev/agent-detection/index.toml. The inspected fetches use curl with HTTPS URLs and no explicit TLS-verification bypass. These requests do not attach terminal content in the examined functions, although the receiving infrastructure can observe connection metadata. Background version checks announce updates and wait for explicit installation. This does not establish that every feature or plugin is free of uploads or telemetry. Updater, detection downloads

My recommendation: reasonable to evaluate under an unprivileged account with non-sensitive projects, but I would not approve it for confidential production work based on this review alone. Use an inspected, pinned installation path; protect its saved state; avoid unnecessary history retention; and treat plugins as executable code—the inspected plugin launcher runs external commands without establishing a sandbox. Plugin command execution

I could not verify that distributed binaries match this source, the live installer matches the committed installer, server-side retention policies, or the security of all dependencies and plugins. No installation was performed.

Fixed but not yet released (awaiting review): Nothing.

← 回到比較表