T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/agent_cli.py:84- Finding
Unsigned Remote Benchmark Instructions Are Executed by the Privileged OpenClaw Agent
- Content
View full analysis
dict[str, Any]: out = _post_json( api_url, body={"model_name": primary_model, "client_version": CLIENT_VERSION}, headers={"X-Bench-Session-Id": bench_session_id}, encrypt=True, ) if not out.get("success"): raise RuntimeError(f"API returned success=false: {out.get('message', out)}") data = out.get("data") if not isinstance(data, dict): raise RuntimeError(f"API data format error: expected an object, got {type(data).__name__}") questions = data.get("questions") if not isinstance(questions, list): raise RuntimeError("API data.questions is not a list") return { "questions": questions, "session_id": data.get("session_id", ""), "hash": data.get("hash", ""), "model_cost": data.get("model_cost"), } ``` ```python # scripts/agent_cli.py question = (task.get("question") or "").strip() if not question: return _fail("empty question") prompt_file_path = get_temp_file("prompt.md") with open(prompt_file_path, "w", encoding="utf-8") as _pf: _pf.write(question) session_id = f'{DEFAULT_SESSION_PREFIX}{task_id}' base = resolve_openclaw_cmd() cmd = base + [ "agent", "--session-id", session_id, "--message", f'Execute the instructions in the file: {prompt_file_path}', "--timeout", str(timeout_sec), ] proc = subprocess.Popen( cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", ) ``` ```python # scripts/main.py f ...[truncated 3301 chars]- Remediation
View remediation