The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the official Tencent IMA skill package as a ZIP archive from the official domain app-dl.ima.qq.com during the installation flow. This download is a core functional requirement and targets a well-known service domain.\n- [COMMAND_EXECUTION]: The skill includes instructions for the agent to execute shell commands such as sed, mv, cp, and chmod to patch known upstream configuration issues and manage local credential files. These operations are explicitly designed to be interactive, providing the user with backups and requiring consent before any file modification.\n- [DATA_EXFILTRATION]: The skill accesses sensitive local paths (~/.config/ima/client_id and ~/.config/ima/api_key) to manage API credentials. These credentials are transmitted to the official ima.qq.com domain for authentication during search and diagnostic operations. This represents standard functional behavior for an API-based management tool.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data retrieved from IMA knowledge bases, which represents a potential injection surface.\n
Ingestion points: The scripts/search_fanout.py script fetches title and highlight_content fields from external APIs (ima.qq.com).\n
Boundary markers: Search results are rendered in plain text for the agent without specific delimiters or isolation instructions.\n
Capability inventory: The skill has the ability to execute shell commands (installer and diagnostic scripts), modify local files (repair strategies), and run Python scripts.\n
Sanitization: No explicit sanitization or filtering of the API-returned content is performed before the data is presented to the agent's context.

ima-copilot