ima-skills · diff
v1.1.8-pinvou2 to v1.1.8-pinvou2
2 added, 2 removed. Audit A to A.
---
name: ima-skills
- description: Tencent IMA OpenAPI skill for notes and knowledge-base operations. Use after the user connects IMA in Pinvou tool store.
+ description: Tencent IMA OpenAPI skill for notes and knowledge-base operations. Use after the user connects IMA in Pinvou Plugin Center.
version: 1.1.8-pinvou2
display_name: "腾讯 ima"
---
# 腾讯 ima OpenAPI
Use this skill when the user asks to search, read, create, append, upload, or organize content in Tencent IMA notes or IMA knowledge bases.
## Credential Rules
Pinvou stores IMA credentials in the local system credential store. The native `ima_openapi` tool reads them only when it sends a request to the fixed official endpoint.
Do not ask the user to paste credentials into the chat. Do not write credentials to `~/.config/ima`, repository files, logs, notes, or artifacts.
Do not probe credentials with shell commands, environment inspection, local files, or ad-hoc network requests. Never pass a host, URL, Client ID, API Key, or HTTP header as tool input.
- To verify access or perform any IMA operation, call `ima_openapi`. If it reports missing credentials, tell the user to connect "腾讯 ima" from the Pinvou tool store.
+ To verify access or perform any IMA operation, call `ima_openapi`. If it reports missing credentials, tell the user to connect "腾讯 ima" from the Pinvou Plugin Center.
## Module Routing
Read the relevant child instruction before operating:
- Notes: read `notes/SKILL.md` for note search, list, read, create, or append.
- Knowledge base: read `knowledge-base/SKILL.md` for knowledge-base search, browsing, upload, URL import, add note to knowledge base, or get media info.
- Cross-module tasks: read both child instructions before acting.
## Native Tool
All calls go through Pinvou's native `ima_openapi` tool. Pass only an allowlisted `api_path` and a JSON object in `body`:
```json
{
"api_path": "openapi/wiki/v1/search_knowledge_base",
"body": {"query": "", "cursor": "", "limit": 20}
}
```
The tool sends POST JSON requests only to `https://ima.qq.com`, applies a response-size limit, and does not expose credentials to the model or subprocesses.
Always parse the response JSON. IMA business success uses `code: 0`; for any non-zero business code, show the returned `msg` to the user without exposing credentials or internal headers.
## Safety
- Never expose `knowledge_base_id`, `media_id`, `folder_id`, `note_id`, Client ID, API Key, or HTTP headers unless the user explicitly needs a technical debug artifact and credentials are redacted.
- Ask before irreversible writes when the target note or knowledge base is ambiguous.
- For note writes, validate UTF-8 text and filter local image references.
- For knowledge-base file uploads, preserve the original file bytes and original filename.