openclaw-rl-training
Warn
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones the framework and core dependencies from external GitHub repositories, including
github.com/Gen-Verse/OpenClaw-RLandgithub.com/THUDM/slime. It also installs Python packages from PyPI such assglang,ray, andopenai. - [REMOTE_CODE_EXECUTION]: The framework requires executing multiple bash scripts (
run_qwen3_7b_openclaw_rl.sh, etc.) downloaded from the remote repository. It also facilitates remote code execution viaray job submittargeting user-defined endpoints like Tinker. - [COMMAND_EXECUTION]: The installation and usage instructions involve running several system-level commands, including
git clone,pip install,bash, andray job submit, to configure the training pipeline and deploy jobs. - [PROMPT_INJECTION]: The skill processes live conversation feedback to train agents, creating an indirect prompt injection surface. Ingestion points: Conversation data is read from
DATA_PATHand intercepted via therl_bufferdirectory. Boundary markers: No explicit markers are documented to distinguish instructions from feedback data. Capability inventory: The skill can execute shell scripts and submit remote training jobs. Sanitization: No sanitization or filtering of conversation feedback or 'next_state' signals is mentioned.
Audit Metadata