Skills Explorer Add Skills

ima-copilot

An agent skill by daymade, from daymade/claude-code-skills. Tags: automation, knowledge-base, search, setup, troubleshooting.

What it does

Installs, troubleshoots, and personalizes the official Tencent IMA skill (a wrapper layer that orchestrates upstream ima-skill, not a replacement). Use when the user mentions IMA, 腾讯 IMA, ima.qq.com, ima-skill, installing or configuring ima-skill, IMA API key / credentials, searching across IMA knowledge bases, 知识库搜索, 笔记搜索, fan-out search with preferred KBs / priority boosting, or wants to diagnose, repair, or personalize an ima-skill install. Also trigger on the missing-YAML-frontmatter bug in ima-skill submodule SKILL.md files and errors like "Skipped loading skill(s) due to invalid SKILL.md".

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill ima-copilot

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/ima-copilot ~/.claude/skills/ima-copilot

Safety box score

Grade D, elevated risk: 65 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill installs and repairs Tencent IMA across local agent directories, then uses IMA's OpenAPI for credential checks, fan-out search, and URL imports. The main risks are networked installs and API calls, plaintext IMA credentials in `~/.config/ima`, and persistent writes to the user's IMA account and skill directories.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution3 (high)It runs shell and Python code plus external commands, including downloading a zip and invoking `npx -y skills add "$SKILL_SRC" -g -y` from the registry in `scripts/install_ima_skill.sh`.
Network access2 (moderate)It downloads the upstream skill from `https://app-dl.ima.qq.com/skills/` and posts authenticated requests to `https://ima.qq.com/openapi/...` for search and credential checks.
Filesystem reach2 (moderate)It reads and writes `~/.config/ima/*`, targets `~/.claude/skills/ima-skill`, `~/.agents/skills/ima-skill`, `~/.openclaw/skills/ima-skill`, and creates backups under `/tmp/ima-copilot-backups/...`.
Secrets & credentials2 (moderate)Credentials are stored as raw files (`~/.config/ima/client_id`, `~/.config/ima/api_key`) or env vars and are sent as `ima-openapi-clientid` / `ima-openapi-apikey` headers.
Privilege & persistence2 (moderate)The installer uses `npx ... -g` to install into user-wide agent locations, which changes the user's agent configuration across multiple tools.
Instruction hijack surface1 (low)The workflow suppresses prompts with `-y` (`npx -y skills add`, `npx -y skills remove`), but it also explicitly requires user consent before upstream-file edits and does not fetch remote instructions.
Irreversible actions2 (moderate)It can install/repair skills and import URLs into the user's IMA account; the import flow notes that no delete endpoint is documented, so writes can persist.
Transparency2 (moderate)Key behavior depends on runtime-fetched artifacts not shipped in the repo: the upstream skill zip from `app-dl.ima.qq.com` and the `npx skills add` package from npm.

Before installing

Rated 2026-10-19 by an automated review of 10 files from the skill's repository.

Source

Repository
daymade/claude-code-skills (all skills from this repository)
Path
ima-copilot/SKILL.md
Branch
main
Updated
2026-09-20