Peter Code Review

提交前质量闸门。快速完成本地测试、静态检查和风险审查，判断“是否可提交”。

This skill is an instruction-driven pre-commit reviewer that will run git commands and whatever project-local scripts exist (lint, typecheck, tests, build, gate:db). Before using it: (1) run it in a trusted/isolated environment (or ensure no sensitive env vars are set), because npm/test/build scripts execute repository code and can perform network I/O or read host env; (2) ensure your machine has the developer tools the skill expects (git, node/npm/npx or ruff/pytest or go/cargo); (3) confirm you trust the repository code (or run inside a container/CI) if you let the agent execute build/test commands; and (4) note the metadata could be clearer about required binaries — if you need guarantees about what the skill will execute, ask the author for an explicit list of expected commands and any safe-run recommendations.

Type: OpenClaw Skill Name: peter-code-review Version: 1.5.0 The skill executes various project-defined scripts (e.g., `npm run lint`, `npm run test`, `pytest`, `go test`, `cargo test`) as part of its code review and quality gate process, as instructed in `SKILL.md`. While these commands are plausibly needed for the stated purpose, they allow the execution of arbitrary code defined within the user's project. This presents a significant vulnerability, as a malicious project could embed harmful scripts that would be executed by the OpenClaw agent when this skill is run on it. Although the skill itself does not exhibit explicit malicious intent (e.g., data exfiltration, persistence), this capability without strong input sanitization or sandboxing constitutes a high-risk behavior.