herdr
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to manage terminal processes, enabling the agent to execute arbitrary shell commands in sibling panes via
herdr pane runandherdr agent prompt. This is the core functionality intended for coordinating work across multiple terminal contexts. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading the output and scrollback from other terminal panes using
herdr pane read. This creates a vulnerability surface where malicious content generated by a separate process or neighbor agent could be interpreted as instructions by the orchestrator. Mandatory Evidence: (1) Ingestion viaherdr pane readinSKILL.md; (2) Lack of instruction-ignoring boundary markers; (3) High-privilege capabilities includingherdr pane runand sub-agent spawning; (4) No sanitization or filtering of the ingested terminal text is described. - [DYNAMIC_EXECUTION]: The instructions frequently use
python3 -cto dynamically parse JSON output from theherdrCLI tool at runtime. This pattern is used to extract session-specific identifiers (pane, tab, and workspace IDs) required for subsequent commands, representing runtime execution of code strings.
Audit Metadata