The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs users to download source code and dependencies from external, non-whitelisted sources.
It clones the primary repository from https://github.com/Gen-Verse/OpenClaw-RL.
It references the slime framework from https://github.com/THUDM/slime for the training backend.
[DYNAMIC_EXECUTION]: The training framework supports loading and executing arbitrary Python code at runtime through command-line arguments.
Parameters like --custom-loss-function-path, --rollout-function-path, and --custom-rm-path allow the skill to load and execute logic from provided file paths (e.g., ./my_method/custom_loss.py).
This dynamic loading mechanism could be exploited if an attacker can write malicious Python files to the expected paths before the training process begins.
[COMMAND_EXECUTION]: The skill relies heavily on the execution of shell scripts and CLI tools to manage the RL pipeline.
It executes scripts such as run_qwen3_7b_openclaw_rl.sh, run_terminal_rl.sh, and run_eval.sh.
It uses ray job submit to send tasks to a potentially remote compute cluster.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for untrusted conversation data used for training.
Ingestion points: Reads conversation trajectories from JSON files and intercepts live multi-turn conversations via the --enable-rl-intercept flag.
Boundary markers: The provided documentation does not specify the use of clear delimiters or instructions to ignore malicious content within the feedback data.
Capability inventory: The skill has significant capabilities including file system access for checkpointing, network access for API serving, and local/remote command execution for training.
Sanitization: There is no explicit mention of sanitizing or validating the next_state or prompt fields in the conversation trajectories before they are used to compute rewards or update the policy.

openclaw-rl-training