小编助手

ReviewAudited by ClawScan on May 13, 2026.

Overview

This writing assistant is mostly aligned with its purpose, but its visible setup instructions can overwrite the user's OpenCode configuration and it relies on external tools, web searches, downloads, and an optional API key.

Before installing, back up ~/.opencode/config.json and avoid running the shown Set-Content command unless it preserves your existing config. Use a dedicated output folder, review or pin the external image/MCP dependencies, and only enable the MiniMax API key or web-search features for material you are comfortable sharing with those services.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The first-use setup could unintentionally delete or change other OpenCode settings, breaking other tools or agent behavior.

Why it was flagged

For an existing OpenCode config that lacks editorAssistant, this example creates a new config object containing only editorAssistant and writes it over ~/.opencode/config.json, which can erase unrelated settings, MCP entries, or other agent configuration.

Skill content
如果配置文件不存在或无 `editorAssistant` 配置... $config = @{ editorAssistant = @{ outputDir = "用户输入的输出目录" } } ... Set-Content -Path "~/.opencode/config.json" -Value $config
Recommendation

Back up ~/.opencode/config.json first, and update only the editorAssistant.outputDir key by merging with existing config instead of overwriting the whole file.

What this means

Using the skill may create local files and send search queries based on your topic or source material, rather than only returning text in chat.

Why it was flagged

The skill explicitly directs the agent to perform web/image searches, download images, and write local Markdown files as part of normal use.

Skill content
必须立即执行保存文章和搜索配图的完整流程... 先搜索配图并下载到 images 目录... 将文章内容直接写入 `{outputDir}/{日期}-{序号}/{文章标题}.md`
Recommendation

Use a dedicated output directory, avoid sensitive unpublished material unless you are comfortable with related searches, and ask the agent not to download or save if you only want a draft.

What this means

Image search, resizing, and MiniMax features depend on external code whose exact reviewed version is not shown here.

Why it was flagged

The skill relies on external packages and an optional MCP package that are not bundled or pinned in the provided artifacts.

Skill content
install_command: "pip install ddgs requests" ... install_command: "cd ~/.agents/skills/image-resizer/scripts && npm install" ... "command": ["uvx", "minimax-coding-plan-mcp", "-y"]
Recommendation

Install dependencies only from trusted sources, prefer pinned versions where possible, and review the separate image-search, image-resizer, and MCP packages before enabling them.

What this means

If enabled, the MiniMax API key may be used for provider calls and could incur account usage or costs.

Why it was flagged

The optional MiniMax integration asks the user to place an API key into MCP configuration; this is expected for that provider but is still credential handling.

Skill content
"environment": { "MINIMAX_API_KEY": "你的API Key", "MINIMAX_API_HOST": "https://api.minimaxi.com" }, "enabled": true ... required: false
Recommendation

Use a scoped API key if available, keep it out of shared files, and monitor provider usage after enabling the MCP.

What this means

Private source material or sensitive topics could be reflected in external search/MCP requests if you use those features.

Why it was flagged

The skill may route topics, article-derived context, or image-related tasks to search providers or the optional MiniMax MCP.

Skill content
MiniMax Token Plan MCP,提供图片理解和网络搜索功能 ... 主动通过必应/Bing搜索尝试补全
Recommendation

Do not enable web/MCP features for confidential drafts unless you accept that related context may leave the local chat environment.