openclaw-rl-training

Warn

Audited by Gen Agent Trust Hub on Mar 18, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones the framework and core dependencies from external GitHub repositories, including github.com/Gen-Verse/OpenClaw-RL and github.com/THUDM/slime. It also installs Python packages from PyPI such as sglang, ray, and openai.
  • [REMOTE_CODE_EXECUTION]: The framework requires executing multiple bash scripts (run_qwen3_7b_openclaw_rl.sh, etc.) downloaded from the remote repository. It also facilitates remote code execution via ray job submit targeting user-defined endpoints like Tinker.
  • [COMMAND_EXECUTION]: The installation and usage instructions involve running several system-level commands, including git clone, pip install, bash, and ray job submit, to configure the training pipeline and deploy jobs.
  • [PROMPT_INJECTION]: The skill processes live conversation feedback to train agents, creating an indirect prompt injection surface. Ingestion points: Conversation data is read from DATA_PATH and intercepted via the rl_buffer directory. Boundary markers: No explicit markers are documented to distinguish instructions from feedback data. Capability inventory: The skill can execute shell scripts and submit remote training jobs. Sanitization: No sanitization or filtering of conversation feedback or 'next_state' signals is mentioned.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 18, 2026, 05:32 PM