AI Islands
中文

tencent-ima-skill

Information Retrieval S rating

Tencent IMA automation skills, CDP controls the local client, supports public and private knowledge base retrieval, allowing AI assistants to safely access personal knowledge assets.

Open external ZIP download → Version：v1.0.0
OpenClaw Claude Code Cursor Codex

Usage instructions

Core usage

This Skill interacts with the locally installed Tencent IMA (ima.copilot) desktop application through Python scripts, and uses the Chrome DevTools Protocol (CDP) protocol to achieve automated control of the client. Users can trigger via natural language commandsima_searchTools to perform public web searches or precise searches against personal private knowledge bases. For the private knowledge base function, users need to obtain and configure it through packet capture in advance.knowledge_id, then used in the query@or@knowledgeprefix to activate exclusive knowledge retrieval mode. Script supportautocloseThe parameter controls whether to automatically close the application after searching. It remains on by default to optimize the continuous query experience.

Significant advantages

Security is the outstanding advantage of this Skill. All code execution is completed locally. The risk of command injection is completely eliminated through subprocess calls in the form of parameter lists, and there are no dangerous functions such as eval/exec. Network communication is strictly limited to the CDP debug port (127.0.0.1:8315) of the local loopback address, ensuring that user query data is not uploaded to third-party servers and only interacts with the official IMA client. The functional design is transparent and controllable. Private knowledge base access requires users to actively configure credentials. There is no silent data collection behavior, and config.json has been added with .gitignore to protect privacy. In addition, the 90-second timeout mechanism and complete error handling ensure execution stability and avoid resource occupation due to process suspension.

Potential Disadvantages and Limitations

Platform compatibility is limited, the current implementation only supports macOS systems and must rely on pre-installation of the official IMA desktop client. There are technical barriers to the configuration process of private knowledge bases. Users need to have certain network packet capture capabilities to obtain Knowledge IDs, which is not user-friendly enough for ordinary users. The function is limited by the locally applied CDP protocol. If the IMA client is not started or the port is occupied, the call will fail. In addition, the script implements functions by intercepting local network requests. Although it is safe, it is an unofficially supported automation solution. It may become invalid with the IMA client update and depends on the stability of a specific version.

Suitable target group

It is mainly intended for heavy users of Tencent IMA, especially professionals who have accumulated a large amount of personal knowledge assets in the IMA knowledge base. Ideal for developers and power users who care about data privacy and want to integrate AI search capabilities into native automated workflows (such as through Clawdbot or Claude). It is of high value to knowledge workers and researchers who need to frequently retrieve information in private documents, as well as technology enthusiasts who want to realize a closed loop of "local AI assistant + private knowledge base". It is not recommended for ordinary users who have no technical background, cannot complete the configuration packet capture steps, or do not understand the CDP protocol.

Risks of use

In terms of performance, each call needs to start or connect to the local IMA application, which has a 90-second timeout limit and is not suitable for real-time query scenarios with high frequency and low latency requirements. In terms of dependency risks, this solution relies on a specific version of the IMA client and CDP protocol. Official application updates may cause the script to become invalid, and continuous attention is required to maintain compatibility. Configuration risks include Knowledge ID as the access credential for the private knowledge base. Improper storage may lead to the leakage of knowledge base content. It is recommended to properly protect the config.json file to avoid credential leakage. In addition, error information is output to stderr. When deploying in a production environment, you need to pay attention to the log collection and monitoring configuration, as well as the occupation of local port 8315.

Safety review

Core usage

IMA Skill is an automated control tool for Tencent's IMA (ima.copilot) desktop client, which enables remote control through Chrome DevTools Protocol (CDP). Core features include:

  • AI search: Directly call IMA’s cloud search capabilities without manually opening the application
  • Private knowledge base injection:pass@or@knowledgePrefix, automatically injected in the requestknowledge_id, to achieve targeted retrieval of private documents
  • automatic shutdown:support--autocloseParameters, the process will automatically exit after the search is completed.

The configuration method is flexible and supports~/.clawd_ima_config.jsonor environment variablesIMA_KNOWLEDGE_ID, users need to provide their own knowledge base ID.

Significant advantages

1. Seamless workflow integration: Knowledge retrieval can be completed without leaving the command line or chat interface, greatly improving efficiency.
2. Privacy-first design: Private knowledge base mode intercepts injection IDs through local CDP to prevent sensitive configurations from being exposed in URLs or history records
3. Safe implementation: Network communication is limited to Tencent official services (ima.qq.com) and local debugging ports, with no risk of data leakage
4. Very light dependence: only depends onwebsocket-client, no complex supply chain attack surface

potential limitations

  • platform dependency: Only supports macOS (Homebrew path is hard-coded), Windows/Linux users need to manually adapt
  • App pre-installation requirements: The IMA client must be installed locally and cannot be run independently.
  • Process management is rough: Lack of automatic cleaning mechanism, abnormal exit may lead to zombie process
  • Configuration without verification: No verificationknowledge_idFormat, misconfiguration will cause silent failure

Suitable for the crowd

  • Knowledge workers who have deeply used IMA as their main knowledge management tool
  • Technical users who need to integrate AI search into automated scripts or chat workflows
  • Privacy-sensitive enterprise users who want localized processing of knowledge base IDs

General risks

  • medium risk：subprocess.PopenStart a local application. Although the path is hard-coded and there is no injection risk, it is a potential attack surface.
  • low risk: Reading environment variables and local network communication are both necessary functions and the scope is controllable.
  • Depends on user behavior: The security level of Knowledge ID depends on the user's storage method, and incorrect submission to version control may lead to leakage.

Certification conclusion

The source is trustworthy (openclaw organization T2 level), the code structure is clear, there are no known CVE vulnerabilities, and it complies with the GDPR data minimization principle. It is recommended to improve process management and configuration verification according to the report recommendations before production use.

productivitydocsautomationcontent-media

Copyright and takedown notice: AI Islands curates this page from public information. Skills, code, documents and packages remain the property of their original authors or rights holders. This listing is provided for indexing, research and installation convenience. If you believe any listing or download link infringes your rights, contact ai-islands@streamflowintel.com with proof of ownership, relevant URLs and your request. We will review and remove or adjust the content promptly. Review package permissions, dependencies and safety risks before installing.

Related Agent Skills