openclaw-rl-training
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone code from a non-trusted repository:
https://github.com/Gen-Verse/OpenClaw-RL.git. - [COMMAND_EXECUTION]: The skill includes an implementation example for a 'Terminal Agent' that uses
subprocess.run(command, shell=True), which allows for arbitrary shell command execution based on model-generated output. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to train models using conversational feedback and trajectories, creating a significant attack surface for indirect prompt injection.
- Ingestion points: Trajectories are collected in
collect_rollouts.pyandrollout_opd.pyfrom live multi-turn conversations and user/environment feedback. - Boundary markers: No explicit boundary markers or 'ignore' instructions are visible in the provided snippets to delimit untrusted feedback data.
- Capability inventory: The training process involves writing model checkpoints to the filesystem, while the associated agent examples demonstrate shell command execution (
subprocess.run) and UI control (pyautogui). - Sanitization: There is no evidence of sanitization, filtering, or validation of the feedback data before it is processed for training.
- [DYNAMIC_EXECUTION]: The framework involves training and fine-tuning models (including LoRA adapters), which dynamically modifies executable model weights based on external data inputs.
Audit Metadata