Tencent Ima Skill Publish

• Outcome: Review
• Latest audit: Jun 5, 2026 · 11:21 PM UTC
• Version: 1.0.2

Overview

This skill mostly matches its IMA notes and knowledge-base purpose, but it grants sensitive note/file access and has under-scoped credential, routing, and unofficial-automation guidance that users should review carefully.

Install only if you intend to let the agent access and modify your Tencent IMA notes and knowledge bases. Keep credentials in a protected secret/env store, do not set IMA_BASE_URL unless you fully trust the destination, confirm before uploads or note writes involving sensitive content, and avoid the cookie/Playwright and undocumented-endpoint probing paths unless you are deliberately testing in an isolated account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code performs an automatic self-update check on every API call path except the update endpoint itself, which is unrelated to the stated knowledge-base/note functionality. This creates an unnecessary outbound communication channel and a control point where a remote service can influence behavior by forcing the skill to emit update metadata and fail with a special error, increasing supply-chain and availability risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The request destination can be overridden via options or the IMA_BASE_URL environment variable, and the code forwards the client ID and API key as headers to whatever host is configured. If an attacker can influence options or environment, they can redirect requests to an arbitrary endpoint and capture credentials or repurpose the skill as a generic authenticated HTTP client outside its declared scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The document explicitly advises future operators to bypass the documented OpenAPI limits by using desktop-client cookies and Playwright automation to restore delete/move/rename capabilities. That encourages credential reuse and UI automation against a different trust boundary, which can lead to unauthorized actions, session leakage, and behavior outside the intended API scope.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger text is extremely broad and includes ordinary phrases like '帮我记一下' and general personal document access language, which can cause the skill to auto-activate for many unrelated conversations. Overbroad routing is dangerous here because this skill has write-capable and credential-aware behavior, so accidental invocation can expose data or cause unintended remote changes.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document explicitly instructs use of `ima-openapi-apikey` and also describes temporary COS credentials (`secret_id`, `secret_key`, `token`) without any handling guidance. In a skill context, agents may surface, log, persist, or echo these values during troubleshooting or file upload flows, which can lead to credential leakage and unauthorized access to storage or APIs.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The quick-decision guidance encourages uploading files and importing URLs into a remote Tencent knowledge base but does not warn that user content will be transmitted to external services and stored remotely. In an agent skill, this omission can cause users or downstream components to send sensitive documents, notes, or URLs off-platform without informed consent, creating privacy, compliance, and data residency risks.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger guidance for note search is broad enough that ordinary user phrasing like 'search' or 'find' can activate the skill without a clear note-specific context. In a privacy-sensitive notes skill, unintended activation can expose metadata or note contents through search results, especially because the skill explicitly handles personal knowledge and memo retrieval.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The creation/import triggers allow broad phrases like saving or generating content as notes, which can cause the agent to write user content to persistent storage without sufficiently explicit consent. Because this skill stores personal documents and notes, accidental invocation can create unintended records and potentially persist sensitive information the user did not mean to save.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Append operations are state-changing and the listed phrases are ambiguous enough to overlap with normal editing instructions, making accidental modification of existing notes plausible. In a personal notes context, unintended appends can corrupt records, mix unrelated data into notes, or alter sensitive documents without clear user intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance explicitly tells the agent that for certain rename failures, the only recovery path is to re-upload and delete the old item in the IMA app, but it does not require an explicit user confirmation or a destructive-action warning before that deletion step. In a knowledge-base/note-management skill, this is meaningfully risky because users may lose content, metadata, or references if the old item is removed without clear consent and impact disclosure.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The reference normalizes active probing of undocumented endpoints and acknowledges that prior probes created persistent knowledge bases, folders, notebooks, notes, and files requiring manual cleanup. Recommending more probing without strong upfront authorization, scope, and cleanup controls can cause unintended data creation, account pollution, and potentially violate platform expectations or rate/security controls.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: ima_api.cjs:31

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: knowledge-base/scripts/cos-upload.cjs:96