ima-copilot

SUSPICIOUS. The skill is broadly coherent with its stated purpose as an installer/troubleshooter wrapper for Tencent IMA, and its credential flow goes to official ima.qq.com endpoints. However, it performs transitive skill installation, dynamic upstream downloads, and local file patching of another skill, which create meaningful trust and integrity risks even without clear evidence of malicious intent.