pinvou/pinvou-agent/ima-skills

腾讯 ima OpenAPI

Use this skill when the user asks to search, read, create, append, import (web page import), or organize content in Tencent IMA notes or IMA knowledge bases.

Credential Rules

Pinvou stores IMA credentials in the local system credential store. The native ima_openapi tool reads them only when it sends a request to the fixed official endpoint.

Do not ask the user to paste credentials into the chat. Do not write credentials to ~/.config/ima, repository files, logs, notes, or artifacts.

Do not probe credentials with shell commands, environment inspection, local files, or ad-hoc network requests. Never pass a host, URL, Client ID, API Key, or HTTP header as tool input.

To verify access or perform any IMA operation, call ima_openapi. The tool is deferred by default: if ima_openapi is not in your tool list, activate it with tool_search first; if tool_search cannot surface it, the ima backend is unavailable this round — say so instead of improvising. If the call reports missing credentials, tell the user to connect "腾讯 ima" from the Pinvou Plugin Center.

Module Routing

Read the relevant child instruction before operating:

• Notes: read notes/SKILL.md for note search, list, read, create, or append.
• Knowledge base: read knowledge-base/SKILL.md for knowledge-base search, browsing, URL import, add note to knowledge base, or get media info.
• Cross-module tasks: read both child instructions before acting.

Native Tool

All calls go through Pinvou's native ima_openapi tool. Pass only an allowlisted api_path and a JSON object in body:

{
  "api_path": "openapi/wiki/v1/search_knowledge_base",
  "body": {"query": "", "cursor": "", "limit": 20}
}

The tool sends POST JSON requests only to https://ima.qq.com, applies a response-size limit, and does not expose credentials to the model or subprocesses.

Always parse the response JSON. IMA business success uses code: 0; for any non-zero business code, show the returned msg to the user without exposing credentials or internal headers.

Safety

• Never expose knowledge_base_id, media_id, folder_id, note_id, Client ID, API Key, or HTTP headers unless the user explicitly needs a technical debug artifact and credentials are redacted.
• Ask before irreversible writes when the target note or knowledge base is ambiguous.
• For note writes, validate UTF-8 text and filter local image references.
• Local file upload is not an ima_openapi capability: only web page import via import_urls and collecting existing notes via add_knowledge are supported. Do not promise the user that local files can be uploaded.