ClawHub

ima_skills_yc

v1.0.0

IMA 个人笔记服务 API skill，用于管理用户的 IMA 笔记。支持搜索笔记、浏览笔记本、获取笔记内容、新建笔记和追加内容。 当用户提到笔记、备忘录、记事、知识库，或者想要查找、阅读、创建、编辑笔记内容时，使用此 skill。 即使用户没有明确说"笔记"，只要意图涉及个人文档的存取（如"帮我记一下"、"我...

⭐ 1· 1k·38 current·39 all-time
bychang yang@laineyboy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description map cleanly to the requested env vars (IMA_OPENAPI_CLIENTID, IMA_OPENAPI_APIKEY) and the documented ima.qq.com OpenAPI endpoints. Nothing required by the skill appears unrelated to managing IMA notes.
ℹ
Instruction Scope
SKILL.md contains explicit runtime instructions (curl wrapper, env-var precheck, workflows for search/list/get/import/append). It also shows examples for reading and re-encoding local files using python3/node/iconv; those are reasonable for importing external text but do mean the agent's runtime may read local temporary files when the user asks to import content. Instructions limit external endpoints to ima.qq.com and include a privacy rule about not exposing full note bodies in group contexts.
✓
Install Mechanism
No install spec and no code files — instruction-only skill. This minimizes the disk/write footprint and there is no download of third-party code or archives.
✓
Credentials
Only two environment variables are required (clientid and apikey), which match the API's authentication scheme and are appropriate for the described functionality. The primaryEnv is set correctly. Note: SKILL.md suggests adding exports to ~/.bashrc or ~/.zshrc which persists keys on the host — a usability suggestion but not a technical requirement of the skill.
✓
Persistence & Privilege
always is false and the skill does not request permanent system privileges or modify other skills. It can be invoked by the agent (normal behavior) but has no elevated persistence mechanisms.
Assessment
This skill appears to do what it says: call the IMA note OpenAPI using two API credentials. Before installing, consider: 1) Only provide IMA_OPENAPI_CLIENTID and IMA_OPENAPI_APIKEY if you trust the ima.qq.com service and the environment running the agent. 2) Avoid storing long-lived API keys in shell rc files on shared machines; consider using a secure secrets store or ephemeral credentials if available. 3) The skill's examples run local commands (python3/node/iconv) to normalize text files for import — if you import files, be aware the agent may read those temporary files. 4) Confirm the Base URL (https://ima.qq.com/openapi/note/v1) is the correct official endpoint for your account. 5) Rotate and revoke the API key if you stop using the skill. If you want extra assurance, request an official SDK or signed release from the service rather than running ad-hoc curl commands.

Like a lobster shell, security has layers — review code before you run it.

latestvk971mj3t2gq04kaq5d12r0qy4n835v2a

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📝 Clawdis
EnvIMA_OPENAPI_CLIENTID, IMA_OPENAPI_APIKEY
Primary envIMA_OPENAPI_CLIENTID

Comments