Peter Commit Ops

提交与建 PR 桥接自动化。负责将“可提交”改动落成 commit、推送分支并创建 PR，衔接 peter-code-review 与 peter-pr-ops。用于用户提到“帮我提交”“推分支”“创建 PR”“从 review 到 merge 串起来”等场景。

This skill appears to do what it says (turn staged changes into commits, push branches, and create PRs), but the metadata omits important runtime expectations. Before installing or enabling it: 1) Confirm the agent environment has git, and (if you want full automation) the GitHub CLI (gh) and any necessary npm tooling. 2) Be aware the skill will use whatever git/GitHub credentials are available — ensure those credentials have appropriately limited scope (e.g., a deploy key or a token without admin rights) or require manual approval before push/PR. 3) Require an explicit confirmation step (or dry-run mode) before any automatic git add/commit/push to avoid unintended repository changes. 4) Prefer the skill to document required binaries and credential requirements in metadata (declare git, gh, npm and note that GH auth is needed). If you cannot trust the environment’s credentials or want stricter control, do not give the agent permission to run this skill autonomously and instead invoke it manually when you can supervise the actions.

Type: OpenClaw Skill Name: peter-commit-ops Version: 1.1.0 The skill instructs the agent to execute `npm run workflow:check` or shell scripts (`tools/workflow-check.sh`, `scripts/workflow-check`) from the user's repository (SKILL.md). This introduces a potential Remote Code Execution (RCE) vulnerability if the repository's scripts are malicious, as the skill itself does not define or validate their content. While the use of `gh pr create --fill` (SKILL.md) involves network interaction and potential data exposure, it aligns with the stated purpose. The skill also includes '护栏' (guardrails) to prevent common dangerous actions like direct pushes to `main`/`master`, indicating an intent for safe operation within its defined scope, but the reliance on untrusted repository scripts makes it suspicious.