herdr-orchestrate

SUSPICIOUS: the purpose is coherent for orchestration, and the main external CLI appears official, but the skill grants an AI agent broad autonomous control over repo operations and merges while ingesting untrusted issue content into delegate prompts. The main concern is disproportionate action authority and prompt-injection exposure, not confirmed malware.

No evidence of covert malware behaviors like persistence or data exfiltration is present in this module. The dominant security issue is the optional `--teardown` feature: it directly executes attacker-controlled shell text via `sh -c` with a derived repository working directory, enabling arbitrary command execution if argv is not strictly trusted. Additionally, the script performs destructive worktree and branch removal operations based entirely on CLI inputs, increasing impact in the event of misuse or compromise.

This file is a non-obfuscated Node.js CLI wrapper that automates sending text (or arbitrary local file contents via `@path`) into a target pane by invoking the external `herdr` binary, then polling pane visible output to decide whether the message “landed.” It is not overtly malicious in itself (no network, no eval/exec, no persistence), but it can be dangerous: it enables arbitrary local file reads and can forward those contents to an external system/pane, and it may leak sensitive pane-visible content in failure output. Operationally, it also executes `herdr` from PATH, so a compromised environment could cause unintended binary execution. Overall: moderate security risk primarily driven by data exposure and boundary trust in `herdr` rather than direct malware behavior.