ash-workflow-setup

ash-workflow-setup is a command for Claude Code from CookiesHaha/ash-claude-skills. It costs 42 tokens per session (1,917 once invoked), scanned B, original, MIT.

A setup wizard for checking and configuring the tools and permissions needed by the Feishu product-requirement workflow. Feishu is a collaboration and document platform.

In plain words
What is it for?
Use it to check or configure lark-cli, Feishu app authentication, OAuth access, MCP connections, and template mappings, with options to skip selected checks.
Why use it?
It finds missing command-line tools, application settings, login permissions, and document mappings before the workflow runs.

Command for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths.

Part of the ash-workflow plugin — 7 skills, 1 command shipped together

Good fit Use it to check or configure lark-cli, Feishu app authentication, OAuth access, MCP connections, and template mappings, with options to skip selected checks.

Compare 6 commands from other repositories ↓
Install with agentmods
npx agentmods add commands/cookieshaha/ash-claude-skills/ash-workflow-setup
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/CookiesHaha/ash-claude-skills

Made for: Claude Code.

Or install ash-workflow, the plugin that ships this one along with the rest of its 7 skills, 1 command.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ash-workflow-setup

README.md
[![agentmods](https://agentmods.dev/badge/commands/cookieshaha/ash-claude-skills/ash-workflow-setup/github.svg)](https://agentmods.dev/commands/cookieshaha/ash-claude-skills/ash-workflow-setup)
Your own site
<a href="https://agentmods.dev/commands/cookieshaha/ash-claude-skills/ash-workflow-setup"><img src="https://agentmods.dev/badge/commands/cookieshaha/ash-claude-skills/ash-workflow-setup/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ash-workflow-setup

Your own site · 80×15
<a href="https://agentmods.dev/commands/cookieshaha/ash-claude-skills/ash-workflow-setup"><img src="https://agentmods.dev/badge/commands/cookieshaha/ash-claude-skills/ash-workflow-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 42 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,917 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00042 $0.01917
Opus 5 $0.00021 $0.00958
Sonnet 5 $0.00008 $0.00383
Haiku 4.5 $0.00004 $0.00192

Measured 10d ago against content hash b53554993666, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade B, and why

ash-workflow-setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

3. 定位模板文件:运行 `find ~/.claude/plugins -name 'template-mapping.local.md.tpl' 2>/dev/null | head -1` 找到模板路径(plugin 安装后路径因版本而异);若未找到,使用内置占位符内容直接生成。
plugins/ash-workflow/commands/ash-workflow-setup.md · 147 lines

How it starts

The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.

参数预处理

若调用时携带参数($ARGUMENTS):

  • 包含 --skip-mcp → Step 4 自动选择"⏭️ 跳过",无需询问用户
  • 包含 --skip-mapping → Step 5 自动选择"⏭️ 跳过",无需询问用户

/ash-workflow-setup — PRD 三件套依赖向导

你是 PRD 三件套依赖向导,帮用户逐步检查并补齐所有运行前提。

重要约束(不可违反):

  1. 禁止擅自执行 lark-cli auth login — OAuth 涉及用户凭据,只给出命令让用户自行执行
  2. 禁止不经确认写入 ~/.claude.json — 必须先 Read 当前内容、展示 diff,用户确认后再 Edit
  3. 幂等 — 已完成的步骤跳过,只补缺

Step 1 · 体检 lark-cli

  • 运行 command -v lark-cli 检查是否安装
  • 缺失 → 提示:

    lark-cli 未安装。请运行以下命令安装: npm install -g @larksuite/lark-cli 安装完成后告知我,我继续下一步。 (询问是否帮你 Bash 执行,需用户授权)

  • 存在 → 运行 lark-cli --version 显示版本,打印 ✅

Step 2 · 体检应用配置

  • 运行 lark-cli config show 2>/dev/null | head -20
  • 无输出或无 App ID → 提示:

    尚未配置飞书应用。请在终端运行: lark-cli config init 按提示填入 App ID 和 App Secret(Claude 不代你输入密钥)。 完成后告知我,我继续下一步。

  • 已配置 → 显示遮罩后的 App ID(只显示前4位 + ****),打印 ✅

Step 3 · 体检 OAuth scope

  • 运行 lark-cli auth status 2>/dev/null 检查当前授权状态
  • 状态为 needs_refresh(token 过期但已授权) → 提示:

    你的 token 已过期,只需刷新,无需重新授权 scope。请在终端运行:

    lark-cli auth login
    

    (不带 --scope,直接刷新 token 即可) 完成后告知我,我继续下一步。

  • 未登录 / 无任何授权 → 提示:

    尚未授权用户身份。请在终端运行以下命令完成授权:

    lark-cli auth login --scope "docs:document.content:read docs:document:export docs:document:import docs:document.comment:read docs:document.comment:create docs:document.comment:update docx:document:write_only docx:document:readonly base:app:read base:app:create base:record:read base:record:create base:record:update wiki:wiki:readonly wiki:node:read wiki:node:create wiki:node:update wiki:space:read"
    

    命令会输出一条授权链接,在浏览器打开并完成授权后告知我。

  • 已就绪(status: active) → 显示用户身份摘要(邮箱或昵称),打印 ✅

Step 4 · 体检 MCP(prd-to-userstory 才需要)

询问用户:

你是否需要使用 prd-to-userstory(把 PRD §5 写入飞书需求矩阵 / 飞书项目)?

  • → 打印 ⏭️ 跳过 MCP 配置,提示"后续需要时重跑 /ash-workflow-setup"
    1. Read ~/.claude.json,检查是否已有 FeishuProjectMcpfeishu 两个 MCP server
    2. 已配置 → 打印 ✅
    3. 未配置 → 展示需要新增的 JSON 片段:
      {
        "mcpServers": {
          "FeishuProjectMcp": {
            "command": "npx",
            "args": ["-y", "@feishu-project/mcp-server"]
          },
          "feishu": {
            "command": "npx",
            "args": ["-y", "@larksuite/feishu-mcp"]
          }
        }
      }
      
    4. 询问:

      是否自动 merge 写入 ~/.claude.json?我会先展示完整 diff。

      • 自动写入 → Read ~/.claude.json → merge mcpServers → 展示 diff → 用户确认 → Edit 注意:merge 时只添加缺失的 server key,不覆盖、不删除 mcpServers 中已有的其他 server 配置。
      • 我自己来 → 给出上方 JSON 片段,提醒手动写入后重跑 /ash-workflow-setup

Read the full file on GitHub · 147 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 147 lines · 0 tokens per session scan B b53554993666

Subscribe to this mod's changes

ash-workflow-setup is a command published in the GitHub repository CookiesHaha/ash-claude-skills (2 stars, last pushed 1mo ago), licensed MIT. It adds 42 tokens to every session and 1,917 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.