跳转到正文
报告库
用途分类 / 开发辅助

Herdr Skill 安全审计

作者说它能做什么(原文)

Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1.

第三方安全检查结论

发现安全风险

已检查文件
1
发现的风险
4
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。发现 1 项风险
中风险

可在同级终端中执行任意命令文本

原文依据:3 处
发现了什么

Skill 指示把一段字符串交给 `herdr pane run`,Herdr 会自动发送命令并按回车。文档没有在此步骤要求显示最终命令或为修改性命令再次确认。

为什么需要注意

若任务内容、复制的命令或目标面板选择有误,命令会以该终端的用户权限运行,可能修改文件、启动服务或使用终端可访问的凭据。

这是实际操作指令,不只是说明或警告。`pane run` 会把给定文本作为 shell 命令并自动按回车;示例本身仅运行测试,但接口可接受其他命令。Skill 只要求用户明确要求使用 Herdr,并未要求在执行每条可能修改文件或环境的命令前再次展示和确认。因此,若代理选用了破坏性或范围过大的命令,可能影响同一工作目录中的文件或进程;用户可要求只运行预先列出的命令并禁止修改性命令。

SKILL.md:164来自说明文档打开原文件
Read the new pane ID from `.result.pane.pane_id`, then run and inspect the command:```bashherdr pane run <returned-pane-id> "just test"herdr pane wait-output <returned-pane-id> --match "test result" --timeout 120000herdr pane read <returned-pane-id> --source recent-unwrapped --lines 120````pane run` atomically sends command text and Enter. `pane wait-output` searches the selected snapshot immediately, so output that already exists can match. Use `--match <text>` for a literal substring or `--regex <pattern>` for a Rust regular expression. Omitting `--timeout` allows an indefinite wait.
查看另外 2 个位置
SKILL.md:3来自说明文档打开原文件
name: herdrdescription: "Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1."---
SKILL.md:172来自说明文档打开原文件
`pane run` atomically sends command text and Enter. `pane wait-output` searches the selected snapshot immediately, so output that already exists can match. Use `--match <text>` for a literal substring or `--regex <pattern>` for a Rust regular expression. Omitting `--timeout` allows an indefinite wait.
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 1 项风险
中风险

读取相邻终端可能把敏感输出带入代理会话

原文依据:5 处
发现了什么

Skill 明确允许检查相邻工作,并可读取代理或普通面板的近期输出、日志和转录。终端历史可能包含令牌、路径、客户数据、命令参数或其他代理的工作内容。

为什么需要注意

被读取的内容会暴露给执行本 Skill 的代理及其会话上下文;证据中没有要求在读取前扫描或遮盖秘密。没有证据表明这些内容会被进一步发送到外部网络。

这是实际读取能力:Skill 允许检查相邻工作,并提供读取指定代理和普通面板近期输出、日志或转录的命令。它要求使用明确的面板 ID 或唯一代理名,降低读错目标的机会,但没有要求在读取前检查或遮蔽终端中的凭据、客户数据或其他敏感内容。若目标终端曾输出这些数据,它们会进入当前代理上下文;用户可限定允许读取的面板和行数,并要求不读取或复述秘密。

SKILL.md:18来自说明文档打开原文件
When the check passes, the `herdr` binary in `PATH` talks to the current session. Use it to inspect neighboring work, create terminal layout, start agents and commands, read output, and wait for state changes.
查看另外 4 个位置
SKILL.md:149来自说明文档打开原文件
```bashherdr agent get reviewerherdr agent read reviewer --source recent-unwrapped --lines 120```
SKILL.md:174来自说明文档打开原文件
Use the read source that matches the task:- `visible`: the currently rendered viewport.- `recent`: recent rendered output, including soft wraps.- `recent-unwrapped`: recent output with soft wraps joined; prefer it for logs and transcripts.- `detection`: the plain-text bottom-buffer snapshot used for agent detection.Use `--format ansi` when colors and terminal styling are evidence. Otherwise use text.
SKILL.md:147来自说明文档打开原文件
Herdr validates all keys before writing any bytes. Read the result through the resolved agent:```bashherdr agent get reviewerherdr agent read reviewer --source recent-unwrapped --lines 120```
SKILL.md:164来自说明文档打开原文件
Read the new pane ID from `.result.pane.pane_id`, then run and inspect the command:```bashherdr pane run <returned-pane-id> "just test"herdr pane wait-output <returned-pane-id> --match "test result" --timeout 120000herdr pane read <returned-pane-id> --source recent-unwrapped --lines 120```
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。发现 1 项风险
中风险

新编码代理默认在用户当前工作目录中运行

原文依据:4 处
发现了什么

Skill 默认继承 `$PWD` 创建面板,然后在该面板启动编码代理并向其提交任务,而不是默认使用隔离的工作树。

为什么需要注意

如果后续提示要求实现或修改内容,且新代理具有相应工具权限,它可能读取或改变用户当前项目;并行代理还可能与用户或其他进程同时修改同一文件。

Skill 明确默认在当前标签页和当前工作目录创建同级面板,并把 `$PWD` 传给新面板;随后可在该面板启动编码代理并提交任务。没有默认工作树或其他文件隔离,因此获准启动的代理可能读取或修改用户当前项目。该风险受“必须明确要求使用 Herdr”和不得擅自改变 cwd/拓扑的限制,但隔离缺失仍属真实风险;用户可要求只读任务或明确使用隔离工作树。

SKILL.md:92来自说明文档打开原文件
Default to a sibling pane in the current tab and the current working directory. Do not create a workspace, tab, worktree, or different cwd unless the user explicitly requests that topology or location.
查看另外 3 个位置
SKILL.md:100来自说明文档打开原文件
Split a wide pane to the right and a narrow or tall pane down. Avoid repeated same-direction splits that create unusably narrow columns or short rows. Keep the user's focus in the calling pane and explicitly preserve the caller's working directory:```bashherdr pane split --current --direction right --cwd "$PWD" --no-focus```
SKILL.md:108来自说明文档打开原文件
An available shell pane must be at its interactive prompt, with the shell itself in the foreground and no foreground command, editor, or agent running. Start a supported agent in that pane with a useful unique name:```bashherdr agent start reviewer --kind codex --pane <returned-pane-id>```Use the kind requested by the user. Run `herdr agent` to inspect the installed kind list and options. Pass native agent arguments only after `--`:```bashherdr agent start reviewer --kind codex --pane <returned-pane-id> -- <agent-args...>```
SKILL.md:122来自说明文档打开原文件
Submit work through the agent surface:```bashherdr agent prompt reviewer "Review the current diff and report only actionable findings." --wait --timeout 120000```
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。发现 1 项风险
中风险

交互按键可中断正在运行的代理操作

原文依据:6 处
发现了什么

Skill 允许向指定代理发送 `esc` 和 `ctrl+c` 等控制键。虽然它要求在审批或提问界面先询问用户,但对发送中断键本身没有同等的明确确认要求。

为什么需要注意

发送到错误目标或错误时机可能取消生成、测试、编辑或其他正在进行的操作;被中断进程也可能留下未完成的输出或中间状态。

Skill 的实时控制指令明确允许向目标代理发送 `esc` 和 `ctrl+c`;后者通常会中断前台操作,可能留下未完成的写入、测试或其他任务。按键会先经 Herdr 验证,且目标应使用唯一代理名或明确 ID,但这只防止无效按键或误选焦点,并不要求在中断前获得用户确认。审批或问题界面另有先询问用户的规则,但未覆盖普通运行状态。用户可要求禁止发送中断键,除非单独批准。

SKILL.md:140来自说明文档打开原文件
Use logical keys for interactive agent UI controls:```bashherdr agent send-keys reviewer escherdr agent send-keys reviewer ctrl+c```
查看另外 5 个位置
SKILL.md:154来自说明文档打开原文件
If a wait fails or returns `blocked`, inspect `agent get` and `agent read` before deciding what input to send. Use the pane surface only when raw terminal control is intentional.
SKILL.md:190来自说明文档打开原文件
- Use `--no-focus` for background work unless the user asked to switch context.- Use `--current`, an explicit pane ID, or a unique agent name. Do not rely on another client's focused pane.- Parse IDs from JSON responses. Do not derive them from sidebar order or examples.
SKILL.md:147来自说明文档打开原文件
Herdr validates all keys before writing any bytes. Read the result through the resolved agent:
SKILL.md:128来自说明文档打开原文件
`agent prompt` honors the pane's live bracketed-paste mode and sends text followed by encoded Enter after a short delay. It rejects an agent already waiting at an approval or question dialog with `agent_blocked` before sending any input. Inspect the blocked UI and ask the user before answering it. For normal agent work, `--wait` is enough: it waits for the first settled `idle`, `done`, or `blocked` state. Do not repeat those defaults with `--until`.
SKILL.md:189来自说明文档打开原文件
- Use `--no-focus` for background work unless the user asked to switch context.- Use `--current`, an explicit pane ID, or a unique agent name. Do not rely on another client's focused pane.- Parse IDs from JSON responses. Do not derive them from sidebar order or examples.
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

6 个说明模块

该 Skill 声明仅在用户明确提到 Herdr 时使用,并要求先检查 HERDR_ENV;检查失败时停止,不从外部控制当前 Herdr 会话。

查看原文
SKILL.md:3来自说明文档打开原文件
name: herdrdescription: "Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1."---
SKILL.md:10来自说明文档打开原文件
Before issuing any control command, verify that this agent is running inside a Herdr-managed pane:```bashtest "${HERDR_ENV:-}" = 1```If the check fails, say that you are not running inside Herdr and stop. Do not inspect or control the focused Herdr session from outside Herdr.

通过 Herdr,Skill 可以查看相邻终端、创建布局、启动编码代理或普通命令,并读取它们的输出;面板操作与代理操作具有不同控制范围。

查看原文
SKILL.md:18来自说明文档打开原文件
When the check passes, the `herdr` binary in `PATH` talks to the current session. Use it to inspect neighboring work, create terminal layout, start agents and commands, read output, and wait for state changes.
SKILL.md:50来自说明文档打开原文件
- Workspace, tab, and pane topology organize terminal locations.- Pane commands control raw terminals, shells, tests, servers, input, and output.- Agent commands control the recognized coding agent currently occupying a pane.A pane exists whether or not it contains an agent. `agent start` requires an existing available shell pane and never creates, splits, or moves layout. Use pane commands for ordinary processes. Use agent commands when Herdr must validate agent identity or interpret `idle`, `working`, `blocked`, `done`, and `unknown` lifecycle states.

默认拓扑是在当前标签页按当前工作目录创建同级面板,并保持用户焦点不变;创建其他工作区、标签页、工作树或目录需要用户明确要求。

查看原文
SKILL.md:92来自说明文档打开原文件
Default to a sibling pane in the current tab and the current working directory. Do not create a workspace, tab, worktree, or different cwd unless the user explicitly requests that topology or location.Honor a direction requested by the user. Otherwise inspect the caller pane:```bashherdr pane layout --pane "$HERDR_PANE_ID"```Split a wide pane to the right and a narrow or tall pane down. Avoid repeated same-direction splits that create unusably narrow columns or short rows. Keep the user's focus in the calling pane and explicitly preserve the caller's working directory:```bashherdr pane split --current --direction right --cwd "$PWD" --no-focus```

Skill 包含若干协调保护:遇到审批或提问界面时先检查并询问用户,不关闭非本次创建的会话对象,也不随意停止或杀死 Herdr 主进程。

查看原文
SKILL.md:128来自说明文档打开原文件
`agent prompt` honors the pane's live bracketed-paste mode and sends text followed by encoded Enter after a short delay. It rejects an agent already waiting at an approval or question dialog with `agent_blocked` before sending any input. Inspect the blocked UI and ask the user before answering it. For normal agent work, `--wait` is enough: it waits for the first settled `idle`, `done`, or `blocked` state. Do not repeat those defaults with `--until`.
SKILL.md:189来自说明文档打开原文件
- Use `--no-focus` for background work unless the user asked to switch context.- Use `--current`, an explicit pane ID, or a unique agent name. Do not rely on another client's focused pane.- Parse IDs from JSON responses. Do not derive them from sidebar order or examples.- Do not close workspaces, tabs, panes, or sessions you did not create unless the user explicitly asked.- Never run `herdr server stop` from an active session unless the user explicitly intends to stop the server and its pane processes.- Never kill the main Herdr process. Use named test sessions for experiments that need an isolated server.- CLI server errors are JSON on stderr with exit status 1. CLI syntax errors exit with status 2.
从这里开始 · 工作说明SKILL.md
herdr
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

运行命令
SKILL.md:12来自说明文档打开原文件
```bashtest "${HERDR_ENV:-}" = 1
SKILL.md:24来自说明文档打开原文件
```bashherdr --help
SKILL.md:30来自说明文档打开原文件
```bashherdr agent
读取文件
SKILL.md:185来自说明文档打开原文件
After that failed read, ask the agent to write its complete response as Markdown in a temporary directory and reply only with the file path, then read the file directly. Use this only as a fallback; do not request file output in the initial prompt.
读取了多少行
196
文件校验值(用于核对版本)
1f9b12ce4f0e854fa7411eb4bf550ef0a6b5f02de1a4bf271878dc75f4e279fb