Skip to content
skillsafebeta
← Report library
Purpose / Development

Herdr Skill Security Audit

What the author says it does (original text)

Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1.

Independent security check

Security risks found

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Arbitrary command text can be executed in a sibling terminal

Source references: 3
What we found

The Skill passes a string to `herdr pane run`, which automatically sends the command and Enter. This step does not require showing the final command or reconfirming commands that make changes.

Why this matters

If task content, copied command text, or the selected pane is wrong, the command runs with that terminal user's permissions and may modify files, start services, or use credentials available to the terminal.

This is an active operating instruction, not merely a warning. `pane run` submits supplied text as a shell command and presses Enter. Although the example only runs tests, the interface can accept other commands. The Skill requires an explicit request to use Herdr but does not require displaying and reconfirming every command that could modify files or the environment. An overly broad or destructive command could therefore affect files or processes in the working directory; a user can restrict it to a preapproved command list and prohibit mutating commands.

SKILL.md:164In the instructionsOpen original file
Read the new pane ID from `.result.pane.pane_id`, then run and inspect the command:```bashherdr pane run <returned-pane-id> "just test"herdr pane wait-output <returned-pane-id> --match "test result" --timeout 120000herdr pane read <returned-pane-id> --source recent-unwrapped --lines 120````pane run` atomically sends command text and Enter. `pane wait-output` searches the selected snapshot immediately, so output that already exists can match. Use `--match <text>` for a literal substring or `--regex <pattern>` for a Rust regular expression. Omitting `--timeout` allows an indefinite wait.
Show 2 other places
SKILL.md:3In the instructionsOpen original file
name: herdrdescription: "Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1."---
SKILL.md:172In the instructionsOpen original file
`pane run` atomically sends command text and Enter. `pane wait-output` searches the selected snapshot immediately, so output that already exists can match. Use `--match <text>` for a literal substring or `--regex <pattern>` for a Rust regular expression. Omitting `--timeout` allows an indefinite wait.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Reading neighboring terminals can expose sensitive output to the agent session

Source references: 5
What we found

The Skill explicitly permits inspecting neighboring work and reading recent agent or ordinary-pane output, logs, and transcripts. Terminal history can contain tokens, paths, customer data, command arguments, or another agent's work.

Why this matters

Read content becomes visible to the agent executing this Skill and its session context; the evidence does not require secret scanning or redaction first. There is no evidence that the content is subsequently sent to an external network.

This is an active read capability: the Skill permits inspecting neighboring work and provides commands to read recent agent or ordinary-pane output, including logs and transcripts. Requiring an explicit pane ID or unique agent name reduces accidental targeting, but there is no instruction to check for or redact credentials, customer data, or other sensitive terminal content first. If such data appeared in the selected terminal, it could enter the current agent context; users can limit allowed panes and line counts and forbid reading or repeating secrets.

SKILL.md:18In the instructionsOpen original file
When the check passes, the `herdr` binary in `PATH` talks to the current session. Use it to inspect neighboring work, create terminal layout, start agents and commands, read output, and wait for state changes.
Show 4 other places
SKILL.md:149In the instructionsOpen original file
```bashherdr agent get reviewerherdr agent read reviewer --source recent-unwrapped --lines 120```
SKILL.md:174In the instructionsOpen original file
Use the read source that matches the task:- `visible`: the currently rendered viewport.- `recent`: recent rendered output, including soft wraps.- `recent-unwrapped`: recent output with soft wraps joined; prefer it for logs and transcripts.- `detection`: the plain-text bottom-buffer snapshot used for agent detection.Use `--format ansi` when colors and terminal styling are evidence. Otherwise use text.
SKILL.md:147In the instructionsOpen original file
Herdr validates all keys before writing any bytes. Read the result through the resolved agent:```bashherdr agent get reviewerherdr agent read reviewer --source recent-unwrapped --lines 120```
SKILL.md:164In the instructionsOpen original file
Read the new pane ID from `.result.pane.pane_id`, then run and inspect the command:```bashherdr pane run <returned-pane-id> "just test"herdr pane wait-output <returned-pane-id> --match "test result" --timeout 120000herdr pane read <returned-pane-id> --source recent-unwrapped --lines 120```
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

A new coding agent runs in the user's current working directory by default

Source references: 4
What we found

The Skill creates a pane inheriting `$PWD`, starts a coding agent there, and submits work to it instead of defaulting to an isolated worktree.

Why this matters

If the later prompt requests implementation or changes and the new agent has suitable tool permissions, it may read or alter the current project. Concurrent agents may also modify the same files as the user or another process.

The Skill explicitly defaults to a sibling pane in the current tab and current working directory, passing `$PWD` into the new pane, after which it can start and prompt a coding agent there. No separate worktree or other file isolation is the default, so an authorized agent may read or modify the user's current project. The explicit-Herdr requirement and prohibition on changing topology or cwd without permission limit the scope, but the lack of isolation remains a real risk; users can require read-only work or an isolated worktree.

SKILL.md:92In the instructionsOpen original file
Default to a sibling pane in the current tab and the current working directory. Do not create a workspace, tab, worktree, or different cwd unless the user explicitly requests that topology or location.
Show 3 other places
SKILL.md:100In the instructionsOpen original file
Split a wide pane to the right and a narrow or tall pane down. Avoid repeated same-direction splits that create unusably narrow columns or short rows. Keep the user's focus in the calling pane and explicitly preserve the caller's working directory:```bashherdr pane split --current --direction right --cwd "$PWD" --no-focus```
SKILL.md:108In the instructionsOpen original file
An available shell pane must be at its interactive prompt, with the shell itself in the foreground and no foreground command, editor, or agent running. Start a supported agent in that pane with a useful unique name:```bashherdr agent start reviewer --kind codex --pane <returned-pane-id>```Use the kind requested by the user. Run `herdr agent` to inspect the installed kind list and options. Pass native agent arguments only after `--`:```bashherdr agent start reviewer --kind codex --pane <returned-pane-id> -- <agent-args...>```
SKILL.md:122In the instructionsOpen original file
Submit work through the agent surface:```bashherdr agent prompt reviewer "Review the current diff and report only actionable findings." --wait --timeout 120000```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Interactive control keys can interrupt an agent's active operation

Source references: 6
What we found

The Skill permits sending control keys such as `esc` and `ctrl+c` to a named agent. Although it requires user input before answering approval or question dialogs, it does not impose the same explicit confirmation requirement for interruption keys.

Why this matters

A key sent to the wrong target or at the wrong time may cancel generation, testing, editing, or another active operation, potentially leaving incomplete output or intermediate state.

The live-control instructions explicitly allow sending `esc` and `ctrl+c` to a target agent. The latter commonly interrupts foreground work and could leave writes, tests, or other tasks incomplete. Herdr validates keys and the Skill calls for a unique agent name or explicit ID, but those measures address invalid input or focus mistakes rather than requiring consent before interruption. The separate rule to ask before answering approval or question dialogs does not cover ordinary running states. Users can prohibit interrupt keys unless separately approved.

SKILL.md:140In the instructionsOpen original file
Use logical keys for interactive agent UI controls:```bashherdr agent send-keys reviewer escherdr agent send-keys reviewer ctrl+c```
Show 5 other places
SKILL.md:154In the instructionsOpen original file
If a wait fails or returns `blocked`, inspect `agent get` and `agent read` before deciding what input to send. Use the pane surface only when raw terminal control is intentional.
SKILL.md:190In the instructionsOpen original file
- Use `--no-focus` for background work unless the user asked to switch context.- Use `--current`, an explicit pane ID, or a unique agent name. Do not rely on another client's focused pane.- Parse IDs from JSON responses. Do not derive them from sidebar order or examples.
SKILL.md:147In the instructionsOpen original file
Herdr validates all keys before writing any bytes. Read the result through the resolved agent:
SKILL.md:128In the instructionsOpen original file
`agent prompt` honors the pane's live bracketed-paste mode and sends text followed by encoded Enter after a short delay. It rejects an agent already waiting at an approval or question dialog with `agent_blocked` before sending any input. Inspect the blocked UI and ask the user before answering it. For normal agent work, `--wait` is enough: it waits for the first settled `idle`, `done`, or `blocked` state. Do not repeat those defaults with `--until`.
SKILL.md:189In the instructionsOpen original file
- Use `--no-focus` for background work unless the user asked to switch context.- Use `--current`, an explicit pane ID, or a unique agent name. Do not rely on another client's focused pane.- Parse IDs from JSON responses. Do not derive them from sidebar order or examples.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill says it is only for explicit Herdr requests and requires an HERDR_ENV check; if the check fails, it stops rather than controlling a Herdr session from outside.

View source
SKILL.md:3In the instructionsOpen original file
name: herdrdescription: "Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1."---
SKILL.md:10In the instructionsOpen original file
Before issuing any control command, verify that this agent is running inside a Herdr-managed pane:```bashtest "${HERDR_ENV:-}" = 1```If the check fails, say that you are not running inside Herdr and stop. Do not inspect or control the focused Herdr session from outside Herdr.

Through Herdr, the Skill can inspect neighboring terminals, create layouts, start coding agents or ordinary commands, and read their output; pane and agent operations have different control scopes.

View source
SKILL.md:18In the instructionsOpen original file
When the check passes, the `herdr` binary in `PATH` talks to the current session. Use it to inspect neighboring work, create terminal layout, start agents and commands, read output, and wait for state changes.
SKILL.md:50In the instructionsOpen original file
- Workspace, tab, and pane topology organize terminal locations.- Pane commands control raw terminals, shells, tests, servers, input, and output.- Agent commands control the recognized coding agent currently occupying a pane.A pane exists whether or not it contains an agent. `agent start` requires an existing available shell pane and never creates, splits, or moves layout. Use pane commands for ordinary processes. Use agent commands when Herdr must validate agent identity or interpret `idle`, `working`, `blocked`, `done`, and `unknown` lifecycle states.

The default topology is a sibling pane in the current tab using the current working directory while preserving user focus; another workspace, tab, worktree, or directory requires an explicit request.

View source
SKILL.md:92In the instructionsOpen original file
Default to a sibling pane in the current tab and the current working directory. Do not create a workspace, tab, worktree, or different cwd unless the user explicitly requests that topology or location.Honor a direction requested by the user. Otherwise inspect the caller pane:```bashherdr pane layout --pane "$HERDR_PANE_ID"```Split a wide pane to the right and a narrow or tall pane down. Avoid repeated same-direction splits that create unusably narrow columns or short rows. Keep the user's focus in the calling pane and explicitly preserve the caller's working directory:```bashherdr pane split --current --direction right --cwd "$PWD" --no-focus```

The Skill includes coordination safeguards: inspect approval/question screens and ask the user, avoid closing session objects it did not create, and avoid stopping or killing the main Herdr process without explicit intent.

View source
SKILL.md:128In the instructionsOpen original file
`agent prompt` honors the pane's live bracketed-paste mode and sends text followed by encoded Enter after a short delay. It rejects an agent already waiting at an approval or question dialog with `agent_blocked` before sending any input. Inspect the blocked UI and ask the user before answering it. For normal agent work, `--wait` is enough: it waits for the first settled `idle`, `done`, or `blocked` state. Do not repeat those defaults with `--until`.
SKILL.md:189In the instructionsOpen original file
- Use `--no-focus` for background work unless the user asked to switch context.- Use `--current`, an explicit pane ID, or a unique agent name. Do not rely on another client's focused pane.- Parse IDs from JSON responses. Do not derive them from sidebar order or examples.- Do not close workspaces, tabs, panes, or sessions you did not create unless the user explicitly asked.- Never run `herdr server stop` from an active session unless the user explicitly intends to stop the server and its pane processes.- Never kill the main Herdr process. Use named test sessions for experiments that need an isolated server.- CLI server errors are JSON on stderr with exit status 1. CLI syntax errors exit with status 2.
Start here · InstructionsSKILL.md
herdr
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:12In the instructionsOpen original file
```bashtest "${HERDR_ENV:-}" = 1
SKILL.md:24In the instructionsOpen original file
```bashherdr --help
SKILL.md:30In the instructionsOpen original file
```bashherdr agent
Read files
SKILL.md:185In the instructionsOpen original file
After that failed read, ask the agent to write its complete response as Markdown in a temporary directory and reply only with the file path, then read the file directly. Use this only as a fallback; do not request file output in the initial prompt.
Lines read
196
File checksum (to compare versions)
1f9b12ce4f0e854fa7411eb4bf550ef0a6b5f02de1a4bf271878dc75f4e279fb