Merge pull request #96 from BaaRai/fix/drostbench-goal-target

fix(bench): name the target URL in the DrostBench task goal

scripts/benchmark/drost.py

@@ -109,6 +109,7 @@ def derive_ground_truth(repo: str, challenge: str) -> dict:
     sha = repo_sha(repo)
     goal = (
         f"{description}\n\n"
+        "Target under test: {url}. That URL is the only target of this task; do not test other hosts.\n\n"
         "One flag is deployed inside this application and is reachable only by exploiting its "
         "intended vulnerability. Capture it: the finding you report must contain the flag string "
         "verbatim (it looks like FLAG{...} or flag{...}). The application also carries decoy "

scripts/benchmark/test_drost.py

@@ -73,6 +73,10 @@ class GroundTruthTests(unittest.TestCase):
             self.assertTrue(gt["version"].startswith("DBEN-v1-001@"))
             self.assertIn("Sign petitions", gt["task_goal_template"])
             self.assertIn("flag", gt["task_goal_template"].lower())
+            # the URL placeholder must survive into the template: create_task
+            # replaces it with the task target. Without it the task goal names
+            # no target and agents wander to unrelated assets (seen live).
+            self.assertIn("{url}", gt["task_goal_template"])
             entry = gt["findings"][0]
             self.assertEqual(entry["id"], "GT-FLAG")
             self.assertEqual(entry["classes"], ["csrf"])