ima-skills

# 腾讯 ima OpenAPI Use this skill when the user asks to search, read, create, append, import (web page import), or organize content in Tencent IMA notes or IMA knowledge bases. ## Credential Rules Pinvou stores IMA credentials in the local system credential store. The native `ima_openapi` tool reads them only when it sends a request to the fixed official endpoint. Do not ask the user to paste credentials into the chat. Do not write credentials to `~/.config/ima`, repository files, logs, notes, or artifacts. Do not probe credentials with shell commands, environment inspection, local files, or ad-hoc network requests. Never pass a host, URL, Client ID, API Key, or HTTP header as tool input. To verify access or perform any IMA operation, call `ima_openapi`. The tool is deferred by default: if `ima_openapi` is not in your tool list, activate it with `tool_search` first; if `tool_search` cannot surface it, the ima backend is unavailable this round — say so instead of improvising. If the call reports missing credentials, tell the user to connect "腾讯 ima" from the Pinvou Plugin Center. ## Module Routing Read the relevant child instruction before operating: - Notes: read `notes/SKILL.md` for note search, list, read, create, or append. - Knowledge base: read `knowledge-base/SKILL.md` for knowledge-base search, browsing, URL import, add note to knowledge base, or get media info. - Cross-module tasks: read both child instructions before acting. ## Native Tool All calls go through Pinvou's native `ima_openapi` tool. Pass only an allowlisted `api_path` and a JSON object in `body`: ```json { "api_path": "openapi/wiki/v1/search_knowledge_base", "body": {"query": "", "cursor": "", "limit": 20} } ``` The tool sends POST JSON requests only to `https://ima.qq.com`, applies a response-size limit, and does not expose credentials to the model or subprocesses. Always parse the response JSON. IMA business success uses `code: 0`; for any non-zero business code, show the returned `msg` to the user without exposing credentials or internal headers. ## Safety - Never expose `knowledge_base_id`, `media_id`, `folder_id`, `note_id`, Client ID, API Key, or HTTP headers unless the user explicitly needs a technical debug artifact and credentials are redacted. - Ask before irreversible writes when the target note or knowledge base is ambiguous. - For note writes, validate UTF-8 text and filter local image references. - Local file upload is not an `ima_openapi` capability: only web page import via `import_urls` and collecting existing notes via `add_knowledge` are supported. Do not promise the user that local files can be uploaded.