Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Tencent IMA knowledge-base organizer; it can change remote wiki and note content, but those actions fit its stated purpose and are documented with safeguards.
Install this only if you want an agent to use your Tencent IMA API credentials to organize and modify your IMA knowledge base. Start with a test or noncritical knowledge base, review proposed moves/tag changes/cascade updates before approving them, and keep API keys out of shared logs, repos, and transcripts.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
move_knowledgecurl -s -X POST "https://ima.qq.com/openapi/wiki/v1/move_knowledge" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
The workflow claims a main guide update can use append_doc while also reporting a version bump from v1.5 to v1.6, but the document elsewhere says append_doc cannot modify frontmatter or version fields. This inconsistency can cause agents to misreport state, create broken provenance/version tracking, and overwrite or append content under false assumptions about successful versioned updates.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
")
# 2. 用完整标题作为 item_name
curl -s -X POST "https://ima.qq.com/openapi/wiki/v1/tag_add" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 测试 API 连通性：调用 search_knowledge_base（注意没有 list_knowledge_bases）
curl -s -X POST "https://ima.qq.com/openapi/wiki/v1/search_knowledge_base" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -s -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -s -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
curl -s -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 列出笔记本（端点是 list_notebook 单数，不是 list_notebooks）
curl -s -X POST "https://ima.qq.com/openapi/note/v1/list_notebook" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
-d '{"cursor": "0", "limit": 20}' | python3 -m json.tool
# 创建笔记本（端点是 add_notebook，不是 create_notebook）
curl -s -X POST "https://ima.qq.com/openapi/note/v1/add_notebook" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
对于 < 3KB 的内容，直接使用 import_doc + curl -d @filepath 写入，跳过 COS 中间环节：
curl -s -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
对于 < 3KB 的内容,直接使用 import_doc + curl -d @filepath 写入,跳过 COS 中间环节:
curl -s -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 注意：端点是 list_note（单数），不是 list_notes
curl -s -X POST "https://ima.qq.com/openapi/note/v1/list_note" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
The document instructs users to supply long-lived API credentials and immediately use them in code and shell commands, but it does not warn that these secrets must be protected or that requests send authenticated data to a remote Tencent service. In a skill context, omission of secret-handling and data-transmission warnings can lead users to paste credentials into logs, shared terminals, repos, or unsafe environments.
This section documents many write operations—creating, renaming, moving, importing, appending, and updating knowledge-base or note content—without clearly warning that these actions directly modify remote user data and may be difficult or impossible to roll back. Given the same file later notes that several delete operations are unsupported, accidental or scripted misuse could cause persistent organizational damage.
The example issues an authenticated remote mutation request that moves files within or across knowledge bases, but the documentation does not foreground that executing it will change server-side state immediately. In this skill context, such commands are more dangerous than read-only examples because they can reorganize or misplace user content at scale.
move_knowledgecurl -s -X POST "https://ima.qq.com/openapi/wiki/v1/move_knowledge" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
This example sends local note content to a remote API to create a note, but it does not clearly warn that user-provided file contents are transmitted off-host and persisted remotely. Without disclosure, users may upload sensitive documents in contexts where they did not intend remote storage or sharing.
}, f, ensure_ascii=False, indent=2)
"
curl -s -X POST "https://ima.qq.com/openapi/note/v1/import_doc" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
The append_doc example transmits new content to a remote note and directly mutates stored data, but the docs do not emphasize either the outbound transmission or the fact that the operation changes an existing note. That combination can cause inadvertent disclosure and integrity issues if operators treat it like a local text-processing step.
append_doc 追加内容curl -s -X POST "https://ima.qq.com/openapi/note/v1/append_doc" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
The document gives operational guidance for destructive or structure-altering actions such as move_knowledge, tag_remove, and tag reapplication, including a warning that move_knowledge clears tags, but it does not require explicit user confirmation or present a prominent safety warning before execution. In a skill whose purpose is reorganizing a live knowledge base, this increases the risk of unintended data loss, metadata corruption, or large-scale restructuring if the agent applies these steps automatically or without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 移动到目标文件夹（src_kb_id == dst_kb_id 表示知识库内移动）
curl -s -X POST "https://ima.qq.com/openapi/wiki/v1/move_knowledge" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
The file title and the entire writing specification require guide notes to be produced in Chinese, but there is no indication that the user can choose another language or that this is a region-specific requirement. This is a natural-language locale policy issue because it forces a specific language by default.
This step sends authenticated requests to an external service and then automatically downloads content from a URL returned by the API, which creates a data-exfiltration and trust-boundary risk if the exported note contains sensitive information or if the returned URL is unexpected. The danger is increased because the example chains the API response directly into a Python fetch without verification or any mention of consent, classification, or destination validation.
# 导出旧版本笔记内容
curl -s -X POST "https://ima.qq.com/openapi/note/v1/export_note" \
-H "ima-openapi-clientid: $IMA_OPENAPI_CLIENTID" \
-H "ima-openapi-apikey: $IMA_OPENAPI_APIKEY" \
-H "Content-Type: application/json" \
The document instructs users to invoke authenticated API calls with client credentials and then fetch exported note content from a returned URL, but it does not include any guidance on protecting credentials, validating the destination, or handling potentially sensitive note data safely. In a skill that operationalizes knowledge-base compilation, these instructions could normalize copying secrets into shell commands and transmitting internal content externally without sufficient safeguards.
The entire skill instruction set, labels, examples, and expected outputs are presented only in Chinese, implying a fixed language/locale for operation. There is no statement that the skill is China-specific or that users may opt into another language, which can violate language-choice policy.
The skill expands ingestion beyond user-provided or existing knowledge-base content by making web search and URL import first-class collection steps. This broadens the data access and transmission surface, can pull in untrusted external content, and may cause user data or workflow context to be sent to third-party services without an explicit permission boundary.
The skill instructs the agent to perform web searches and URL imports without an explicit user-facing warning that data will leave the local/platform boundary and that untrusted external content will be brought in. This creates a transparency and consent problem and increases risk of privacy leakage or unreviewed ingestion of hostile content.
No suspicious patterns detected.