Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dropfan/claude-code-plugins/lark-contactnpx skills add DropFan/claude-code-plugins --skill lark-contactgit clone --depth 1 https://github.com/DropFan/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00120 | $0.01315 |
| Opus 5 | $0.00060 | $0.00658 |
| Sonnet 5 | $0.00024 | $0.00263 |
| Haiku 4.5 | $0.00012 | $0.00131 |
Grade A, and why
lark-contact scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
92% identical to lark-contact — 11 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚙️ Cowork / Claude Desktop 执行环境说明（自动注入）
本技能依赖本地
lark-cli（@larksuite/cli，可用command -v lark-cli定位）及其~/.lark-cli登录态（应用密钥存于 macOS keychain）。在 Cowork 中运行任何
lark-cli命令时，必须在本地 macOS 上执行（使用 Desktop Commander 的start_process/interact_with_process，或其它本地 shell 工具），不要用隔离的 Linux 沙箱mcp__workspace__bash——沙箱里没有 lark-cli、也读不到 keychain。 执行前确保 npm 全局 bin 目录（npm prefix -g输出目录下的bin）在 PATH 中。（在 Claude Code 中可忽略本说明，lark-cli 在本机 shell 直接可用。）
选哪个命令
user 身份和 bot 身份是两条完全独立的路径。先确定当前身份,再按下表选命令:
| 想做什么 | user 身份 | bot 身份 |
|---|---|---|
| 按姓名 / 邮箱搜员工拿 open_id | +search-user |
不支持 |
| 按关键词搜索当前用户可见的机器人 / 智能体 | +search-bot |
不支持 |
| 已知 open_id 取他人资料 | +search-user --user-ids <id> |
+get-user --user-id <id> |
| 查看自己 | +get-user 或 +search-user --user-ids me |
不支持 |
| 查同事的个人状态 / 签名 | user_profiles batch_query |
不支持 |
已知 open_id 只是想发消息 / 排日程,不必经过 contact —— 直接 lark-im / lark-calendar。
名字没说清是人还是机器人 / 智能体
用户给的名字常常不表明类型。例如「和 reviewDuck 约个会」里的 reviewDuck 可能是同事昵称,也可能是机器人。
- 名字含 bot / agent / AI / 助手 / 机器人 / 智能体 / assistant 等明显特征时,反过来先搜机器人更快
- 不确定的话两边都搜一下
典型场景
找张三给他发消息:先搜,确认 open_id,再发:
lark-cli contact +search-user --query "张三" --has-chatted --as user
lark-cli im +messages-send --user-id ou_xxx --text "Hi!"
批量查同事的个人状态 / 个性签名(先用 schema 看参数)。
lark-cli schema contact.user_profiles.batch_query
lark-cli contact user_profiles batch_query \
--params '{"user_id_type":"open_id"}' \
--data '{"user_ids":["ou_xxx","ou_yyy"],"query_option":{"include_personal_status":true,"include_description":true}}' \
--as user
搜索命中多条且后续操作有副作用(发消息、邀请会议等),把候选列给用户挑;不要擅自选第一条。
搜索机器人 / 智能体
+search-bot 使用 user 身份按关键词搜索当前用户可见的机器人,返回 ou_ 开头的机器人 open_id。参数细节等见 lark-contact-search-bot.md。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 83 lines · 120 tokens per session scan A 61860533af81
lark-contact is a skill published in the GitHub repository DropFan/claude-code-plugins (7 stars, last pushed 27d ago), licensed MIT. It adds 120 tokens to every session and 1,315 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. It is 92% identical to lark-contact, differing in 11 lines, and is treated as a copy.
Other skills, from other repositories
auto-loop
TDD-based autonomous development loop with checkpoint recovery and observability changelog.
hook-template
Generate hook script from template. Use when adding a new hook, wiring a PreToolUse/PostToolUse/Stop/Notification hook, or scaffolding hook config for settings.json.
agent-check
Validate custom agent file format and structure. Use after creating or editing an agent, before committing agent changes, or when an agent fails to load.
session-relay
Continue real repository work between Claude Code, Codex CLI, and Grok Build with a privacy-bounded, drift-aware handoff packet. Use for cross-vendor takeover, context-limit checkpoints, multi-hop Claude→Codex→Grok relays, or receiving an existing Director packet. Use native resume commands for same-CLI history; never…
skill-check
Validate skill/command file format and structure. Use after creating or editing a skill, before committing skill changes, or when a skill fails to load or trigger.
skill-template
Generate custom skill/command from template. Use when creating a new skill or slash command from scratch, or scaffolding a skill file with correct frontmatter.