Tools
Liberate
By An OpenClaw plugin for reproducible, model-specific jailbroken-agent security testing.
Install
npm install
npmConfiguration Example
{
"provider/model-id": "model-id.md"
}README
# openclaw-liberate
`openclaw-liberate` is an OpenClaw plugin for creating isolated,
model-specific jailbroken-agent testing environments. It can enable or disable
a bundled jailbreak prompt independently for each OpenClaw session.
This project is a proof of concept for authorized security research and
jailbroken-agent testing. Run it in an isolated OpenClaw instance with minimal
credentials, tools and network access. Do not use it to probe or act on systems
without the owner's explicit permission, bypass access controls or violate a
model provider's terms.
Read [this blog post](https://lukasfischnaller.com/blog/jailbreaking-openclaw-agents/) for details.
## Supported models
The bundled prompt profiles currently support these provider/model mappings:
| Model | Provider/model identifiers |
| --- | --- |
| Gemma 3 27B Instruct | `openrouter/google/gemma-3-27b-it`, `venice/google-gemma-3-27b-it` |
| Llama 3.3 70B Instruct | `openrouter/meta-llama/llama-3.3-70b-instruct`, `venice/llama-3.3-70b` |
| Qwen3 Next 80B A3B Instruct | `openrouter/qwen/qwen3-next-80b-a3b-instruct`, `venice/qwen3-next-80b` |
| GLM-4.6 | `zai/glm-4.6`, `openrouter/z-ai/glm-4.6`, `venice/zai-org-glm-4.6` |
Provider availability and model identifiers can change. Using a hosted model
remains subject to the inference provider's terms and the underlying model's
licence or acceptable-use terms.
## Installation
Install through OpenClaw:
```bash
openclaw plugins install npm:openclaw-liberate
```
Restart the OpenClaw Gateway after installation. For local development, use a
linked or packed installation and inspect the resulting runtime registration:
```bash
openclaw plugins install --link ./openclaw-liberate
openclaw plugins inspect openclaw-liberate --runtime --json
```
Build and pack the installable artifact with:
```bash
npm install
npm run build
npm pack
```
Test installation from the exact tarball with
`openclaw plugins install npm-pack:./openclaw-liberate-0.1.0.tgz`.
## Usage
Select a model, start or open an OpenClaw session and use:
```text
/liberate on
/liberate off
/liberate status
```
`/liberate on` enables liberation for the current session.
`/liberate off` disables liberation for the current session.
If the effective model has no configured prompt, the plugin does not inject
one and writes the model and supported mappings to the Gateway log. New
sessions default to liberation off.
## How it works
Model mappings live in [`prompts/models.json`](prompts/models.json). Each value
names a bundled Markdown file in the same directory. When liberation is
enabled, the plugin reads the selected file and returns its contents through
OpenClaw's `prependSystemContext` prompt hook.
Prompt files are read for every liberated turn, while `models.json` is loaded
when the plugin starts. Prompt-text changes therefore take effect immediately
in an installed development copy; mapping changes require a Gateway restart.
Liberation state is stored at:
```text
$OPENCLAW_STATE_DIR/plugins/openclaw-liberate/state.json
```
The store maps each enabled session key to its current session ID. It is
written atomically with mode `0600`, and a new conversation under the same key
defaults to liberation off because its session ID changes.
To add a model, add its provider/model mapping and a corresponding Markdown
file:
```json
{
"provider/model-id": "model-id.md"
}
```
Keep provider-specific identifiers explicit where providers expose different
routes for the same underlying model.
## Safe testing
- Use a dedicated OpenClaw instance or disposable virtual machine.
- Grant only the tools and network access required for the test.
- Do not connect production accounts or sensitive data.
- Use scoped, disposable API credentials with spending limits.
- Treat model output as untrusted and retain human approval for actions.
- Define the authorized target scope before cybersecurity testing.
- Use responsible-disclosure channels for newly discovered provider-specific
weaknesses where appropriate.
## Licence and attribution
Copyright © 2026 Lukas Fischnaller.
This project is distributed under the GNU Affero General Public License,
version 3. See [`LICENSE`](LICENSE).
The bundled prompt material is adapted from
[L1B3RT4S](https://github.com/elder-plinius/L1B3RT4S), retrieved from the
upstream commit recorded in [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).
L1B3RT4S is also distributed under AGPL-3.0. The notices describe which files
contain adapted material and how they were modified for this plugin.
tools
Comments
Sign in to leave a comment