RLM Controller

RLM-style long-context controller that treats inputs as external context, slices/peeks/searches, and spawns recursive subcalls with strict safety limits. Use...

Security Scan

The skill's bundled scripts, tests, and documentation are consistent with its stated RLM long‑context controller purpose; required artifacts and safeguards (path validation, regex timeouts, redaction, hard limits) line up with the description.

Purpose & Capability

Name/description describe a long-context controller and the repository actually contains scripts and docs implementing that behavior (context store, peek/search/chunk, planning, spawn manifest, redaction, cleanup). No unexpected environment variables, binaries, or installers are requested. The presence of test files and policy/docs matches the claimed purpose.

Instruction Scope

SKILL.md instructs the agent to call only bundled helper scripts and OpenClaw tools (read, write, exec, sessions_spawn). Many scripts were provided and they contain explicit safeguards: shared path validation (rejects '..' and enforces realpath containment), regex search timeout to mitigate ReDoS, secret redaction prior to writing subcall prompts, and limits on slices/subcalls. However a subset of files were omitted from the pasted source (12 files truncated). The docs and an included audit response assert that rlm_emit_toolcalls and related emission code enforce safelists; those enforcement claims are plausible given the shown tests and modules, but full verification requires reviewing the omitted files (notably any file that emits tool names or invokes exec).

Install Mechanism

No install spec (instruction-only skill) and all helper scripts are bundled. This is the lowest-risk install model for skills because no external downloads or extract operations occur at install time.

Credentials

The skill declares no required environment variables, no primary credential, and no required config paths. The redaction logic explicitly targets common secret patterns (PEM blocks, bearer/basic tokens, AWS keys, passwords, long hex strings). Asking for no secrets is proportional to the stated functionality.

Persistence & Privilege

The skill does not set always:true and does not request persistent system privileges. It does allow autonomous model invocation by default (disableModelInvocation not set), which is a documented trade-off: useful for large batch runs but increases the range of autonomous operations. Hard limits (max recursion depth 1, max subcalls/slices/batches) and platform constraints (sub-agents cannot spawn sub-agents) reduce the blast radius. Operators with stricter threat models are advised to set disableModelInvocation: true.

Scan Findings in Context

[instruction_scope_missing_enforcement] expected: The OpenClaw scanner flagged that SKILL.md referenced exec and sessions_spawn but did not show enforcement of safelists. This is a reasonable scanner finding; the repository now includes path validation, input checks, regex timeouts, and redaction. Reviewers should still inspect emission/spawn code (some files were truncated in the provided listing) to confirm enforcement is implemented end-to-end.

[autonomous_invocation_privilege] expected: The scanner noted the skill allows autonomous invocation (disableModelInvocation not set). This is an expected design choice for a batch-oriented RLM controller; it is documented as a trade-off. It is not a disqualifying issue by itself, but operators should consider enabling explicit confirmation in high-security environments.

Assessment

This skill appears internally consistent and implements the safeguards it documents (path containment, regex timeouts, secret redaction, hard caps on slices/subcalls). Before installing: 1) Review the few truncated/omitted files (particularly any toolcall emission or spawn code) to confirm tool names are hard-coded and no network calls or dynamic exec of model output are present. 2) If you operate in a high-security environment, set disableModelInvocation: true so the agent cannot autonomously spawn batches without your approval. 3) Run the bundled tests locally to validate behavior in your environment (note: SIGALRM-based regex timeouts are Unix-specific). 4) Confirm cleanup.sh points only at a workspace scratch path you control and adjust CLEAN_ROOT/ignore rules if needed. If you cannot review the omitted files, treat the skill as 'suspicious' until a full code review is completed.

RLM Controller Skill

What it does

Provides a safe, policy-driven scaffold to process very long inputs by:

• storing the input as an external context file
• peeking/searching/chunking slices
• spawning subcalls in batches
• aggregating structured results

When to use

• Inputs too large for context window
• Tasks requiring dense access across the input
• Large logs, datasets, multi-file analysis

Core files (this skill)

Executable helper scripts are bundled with this skill (not downloaded at runtime):

• scripts/rlm_ctx.py — context storage + peek/search/chunk
• scripts/rlm_plan.py — keyword-based slice planner
• scripts/rlm_auto.py — plan + subcall prompts
• scripts/rlm_async_plan.py — batch scheduling
• scripts/rlm_async_spawn.py — spawn manifest
• scripts/rlm_emit_toolcalls.py — toolcall JSON generator
• scripts/rlm_batch_runner.py — assistant-driven executor
• scripts/rlm_runner.py — JSONL orchestrator
• scripts/rlm_trace_summary.py — log summarizer
• scripts/rlm_path.py — shared path-validation helpers
• scripts/rlm_redact.py — secret pattern redaction
• scripts/cleanup.sh — artifact cleanup
• docs/policy.md — policy + safety limits
• docs/flows.md — manual + async flows

Usage (high level)

1. Store input via rlm_ctx.py store
2. Generate plan via rlm_auto.py
3. Create async batches via rlm_async_plan.py
4. Spawn subcalls via sessions_spawn
5. Aggregate results in root session

Tooling

• Uses OpenClaw tools: read, write, exec, sessions_spawn
• exec is used only to invoke the safelisted helper scripts bundled in scripts/
• Does not execute arbitrary code from model output
• All emitted toolcalls are validated against an explicit safelist before output

Autonomous Invocation

• This skill does not set disableModelInvocation: true
• Operators who want explicit user confirmation before every spawn/exec should set disableModelInvocation: true in their OpenClaw configuration
• In default mode, the model may invoke this skill autonomously; all operations remain bounded by policy limits

Security

• Only safelisted helper scripts are called
• Max recursion depth = 1
• Hard limits on slices and subcalls
• Prompt injection treated as data, not instructions
• See docs/security.md for foundational safeguards
• See docs/security_checklist.md for pre/during/post run checks

OpenClaw sub-agent constraints

Per OpenClaw documentation (subagents.md):

• Sub-agents cannot spawn sub-agents
• Sub-agents do not have session tools (sessions_*) by default
• sessions_spawn is non-blocking and returns immediately

Cleanup

Use scripts/cleanup.sh after runs to purge temp artifacts.

• Retention: CLEAN_RETENTION=N
• Ignore rules: docs/cleanup_ignore.txt (substring match)

Configuration

See docs/policy.md for thresholds and default limits.