ima_skills_yc

The documented capabilities match the stated purpose: search, list, read, create, and append IMA notes via the IMA OpenAPI. These operations inherently handle private note content and persistent account data.

The main skill says to trigger even when the user does not explicitly mention notes if the intent involves personal document storage or retrieval, and the reference API includes generic triggers such as search and import notes. For a private-notes tool with read and write authority, that scope is under-defined.

The artifact contains markdown documentation and metadata only, with no executable installer or background component. There is a provenance consistency note because packaged _meta.json lists a different owner/slug/version from the registry context.

Requiring IMA client ID and API key is proportionate for an IMA API integration, and requests are directed to ima.qq.com, but those credentials authorize access to private notes.

The skill has no self-persistence or elevated privileges, but it recommends placing API credentials in shell startup files and documents create/append operations that persistently modify the user's IMA notes without a prominent confirmation requirement.