Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/riba2534/feishu-cli/claude-mdgit clone --depth 1 https://github.com/riba2534/feishu-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/riba2534/feishu-cli/claude-md)<a href="https://agentmods.dev/instructions/riba2534/feishu-cli/claude-md"><img src="https://agentmods.dev/badge/instructions/riba2534/feishu-cli/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.10182 | $0.10182 |
| Opus 5 | $0.05091 | $0.05091 |
| Sonnet 5 | $0.02036 | $0.02036 |
| Haiku 4.5 | $0.01018 | $0.01018 |
Grade C, and why
feishu-cli CLAUDE.md scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
7. 验证:`curl -fsSL https://raw.githubusercontent.com/riba2534/feishu-cli/main/install.sh | bash` Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
7. 验证:`curl -fsSL https://raw.githubusercontent.com/riba2534/feishu-cli/main/install.sh | bash` How it starts
The opening of the file, as written. The whole thing — 462 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md - 飞书 CLI 项目指南
项目概述
feishu-cli 是一个功能完整的飞书开放平台命令行工具,核心功能是 Markdown ↔ 飞书文档双向转换,支持文档操作、消息发送、权限管理、审批查询、知识库操作、文件管理、评论管理等功能。
技术栈
| 组件 | 选型 | 说明 |
|---|---|---|
| CLI 框架 | github.com/spf13/cobra | 子命令、自动补全 |
| 飞书 SDK | github.com/larksuite/oapi-sdk-go/v3 | 官方 SDK |
| 配置管理 | github.com/spf13/viper | YAML/环境变量 |
| Markdown | github.com/yuin/goldmark | GFM 扩展支持 |
项目结构:
cmd/(CLI 命令)、internal/auth(OAuth)、internal/client(API 封装)、internal/converter(Markdown 转换器)、skills/(Claude Code 技能)。按需ls查看详情。
开发指南
构建与测试
go build -o feishu-cli . # 快速构建
make build # 构建到 bin/feishu-cli
make build-all # 多平台构建(发版用,自动注入版本号)
go test ./... # 运行所有测试
go vet ./... # 静态检查
质量标准(任何改动提交前必须满足)
- 实物验证铁律:任何改动,都必须使用实际编译的二进制产物进行验证。
先
go build -o feishu-cli .(或make build)编译当前代码,再用编译出的二进制 实跑受影响的命令确认行为符合预期(读操作真实调用;写操作优先--dry-run,必要时 在测试文档/画板上真实执行)。禁止只凭go vet、单元测试或静态读代码就宣告完成; 文档/技能中对 CLI 行为的描述,同样以新编译二进制的实跑结果为准。 - 基线全绿:
gofmt -l cmd internal无输出、go test ./...、go vet ./...通过。 - 结论附证据:报告"已完成/已修复"必须附带验证命令及其输出(或退出码/截图), 不做未验证的声明。
- 可执行文档必须实跑:README / skills 里给出的命令、脚本、示例,改动后逐条实跑;
涉及可视化配色的改动,从仓库根运行
node skills/feishu-cli-visual/references/workflows/dataviz/scripts/validate_palette.js复验定稿色板、node skills/feishu-cli-visual/references/workflows/dataviz/scripts/check_docs.js核查文档一致性,全绿才算完成。 - Skill 结构校验:修改
skills/、CLI 命令或源码中的 Skill 路径后运行make check-skills; 该目标会先从当前源码重新构建bin/feishu-cli,再检查 Skill 结构、引用和命令唯一归属。 - 隐私扫描:提交前按下方"开发规范"第 6 条检查敏感信息。
发版有更严格的完整清单,见「发布 Release 规范」。
开发规范
- 错误处理:使用中文错误信息,提供解决建议
- 命令帮助:所有命令使用简体中文描述
- 代码注释:关键逻辑使用中文注释
- 提交信息:遵循 Conventional Commits 规范
- 指针解引用:使用
internal/client/helpers.go中的StringVal/BoolVal/IntVal等工具函数 - 错误码分支判定:用
client.HasAPICode(err, 码)(词边界安全,internal/client/api_code.go),禁止对 err.Error() 做数字 substring 匹配(会撞 log_id 同数字串) - 命令组守卫:
cmd/command_guard.go在 Execute 时给所有命令组注入未知子命令守卫(报错+拼写建议+exit 1);新增命令组无需额外处理,但不要给纯分组命令手写 RunE - 发送者名字:读消息统一带
with_sender_name=true,服务端回填名经internal/client/sender_names.go进程级注册表采集,ResolveSenderNames三步解析(服务端回填 → mentions → contact 兜底) - 隐私安全(开源项目,必须遵守):
- 代码、文档、技能文件中禁止出现任何真实的个人邮箱、密码、Token、密钥
- 示例邮箱统一使用
[email protected],示例 Token 使用cli_xxx、u-xxx等占位符 - 新增或修改文件前,检查是否包含
@bytedance.com、@lark.com等内部邮箱域名 - URL 域名使用通用的
feishu.cn,禁止带企业前缀(如bytedance.feishu.cn) .env、config.yaml等含敏感信息的文件已在.gitignore中排除,禁止提交
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 462 lines · 10,182 tokens per session scan C 11c76d012672
feishu-cli CLAUDE.md is an instructions file published in the GitHub repository riba2534/feishu-cli (1,378 stars, last pushed 6d ago), licensed MIT. It adds 10,182 tokens to every session, about $0.0509 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
next.js AGENTS.md
Instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.