ami

• Risk level: Low
• Analyzed: Apr 2, 2026, 6:10 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code, instructions, and required credentials align with its stated purpose (IMA notes & knowledge-base) and do not request unrelated access.

This skill appears to do what it says: it needs your IMA Client ID and API Key to call ima.qq.com and to obtain temporary COS upload credentials. Before installing: (1) Only provide credentials you trust the ima.qq.com service with — consider creating a limited API key if possible. (2) Be aware the skill can read local files you ask it to upload (it will run preflight-check and upload scripts); do not instruct it to upload sensitive system files. (3) The skill reads credentials from environment variables or ~/.config/ima — storing secrets in plain files is convenient but has risk; prefer environment variables or secure storage. (4) The upload flow will send temporary COS credentials to a myqcloud/COS endpoint (returned by the IMA API) — this is expected but those temporary credentials are sensitive and used for the upload. (5) If you need additional assurance, ask the developer for an explicit statement about logging/telemetry and for an option that avoids writing credentials to disk.