The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Python scripts (scripts/ima_kb.py, scripts/ima_notes.py) to interface with the IMA API. These scripts strictly use the Python standard library (urllib.request) and handle CLI arguments safely via argparse without any dynamic code execution risks.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to https://ima.qq.com. This is the official API endpoint for the Tencent IMA service, a well-known service domain, making these operations safe and intended for the skill's functionality.
[CREDENTIALS_UNSAFE]: The skill requires API credentials (IMA_OPENAPI_CLIENTID, IMA_OPENAPI_APIKEY). The documentation correctly instructs the user to store these in environment variables or a local configuration file in the user's home directory (~/.config/ima/), which is consistent with secure development practices.
[PROMPT_INJECTION]: The skill retrieves note content and search results from the IMA service, which constitutes an indirect prompt injection surface.
Ingestion points: Data enters via scripts/ima_notes.py (cmd_read) and scripts/ima_kb.py (cmd_search).
Boundary markers: None identified in the provided templates.
Capability inventory: Network requests via urllib.request to ima.qq.com, and note modification via import_doc and append_doc in scripts/ima_notes.py.
Sanitization: Content retrieved from the API is processed as-is.

openakita/skills@tencent-ima