Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dropfan/claude-code-plugins/lark-sharednpx skills add DropFan/claude-code-plugins --skill lark-sharedgit clone --depth 1 https://github.com/DropFan/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00049 | $0.03243 |
| Opus 5 | $0.00024 | $0.01622 |
| Sonnet 5 | $0.00010 | $0.00649 |
| Haiku 4.5 | $0.00005 | $0.00324 |
Grade A, and why
lark-shared scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 223 lines — stays where its author put it; the contents beside it link to each section on GitHub.
⚙️ Cowork / Claude Desktop 执行环境说明（自动注入）
本技能依赖本地
lark-cli（@larksuite/cli，可用command -v lark-cli定位）及其~/.lark-cli登录态（应用密钥存于 macOS keychain）。在 Cowork 中运行任何
lark-cli命令时，必须在本地 macOS 上执行（使用 Desktop Commander 的start_process/interact_with_process，或其它本地 shell 工具），不要用隔离的 Linux 沙箱mcp__workspace__bash——沙箱里没有 lark-cli、也读不到 keychain。 执行前确保 npm 全局 bin 目录（npm prefix -g输出目录下的bin）在 PATH 中。（在 Claude Code 中可忽略本说明，lark-cli 在本机 shell 直接可用。）
lark-cli 共享规则
本技能指导你如何通过lark-cli操作飞书资源, 以及有哪些注意事项。
配置初始化
首次使用需运行 lark-cli config init 完成应用配置。
当你帮用户初始化配置时，使用background方式使用下面的命令发起配置应用流程，启动后读取输出，从中提取授权链接并发给用户。
URL 转发规则：当命令输出 verification_url、verification_uri_complete、console_url 等 URL 字段时：必须生成二维码：你必须调用 lark-cli auth qrcode 将 URL 转为二维码并展示给用户，这是必须步骤，不要跳过。优先生成 PNG 二维码（--output）；仅当用户明确要求时才使用 ASCII（--ascii）。URL 输出规则：将 URL 视为不可修改的 opaque string，不要做任何修改（包括 URL 编码/解码、添加空格或标点、重新拼接 query），二维码和链接请一起展示给用户。
# 发起配置（该命令会阻塞直到用户打开链接并完成操作或过期）
lark-cli config init --new
认证
认证任务速查
认证、scope、业务域、登录态、退出登录态、撤销授权问题都走本技能。
| 用户意图 | 首选命令 / 回答 |
|---|---|
| 获取全部权限 | lark-cli auth login --domain all --no-wait --json |
| 按业务域授权 | lark-cli auth login --domain docs --domain drive --no-wait --json；--domain 可重复，也可用逗号分隔 |
| 指定单个 scope 授权 | lark-cli auth login --scope "<scope>" --no-wait --json |
| 检查当前登录态、是谁登录、token 是否有效 | lark-cli auth status --json --verify；回答时引用 identity、verified、identities.user.status、identities.user.userName、identities.user.openId（用户 open id）、identities.user.tokenStatus、identities.user.scope |
| 快速查看当前身份状态 | lark-cli whoami；实际生效的那一个身份 |
| 退出当前机器的用户登录态 | lark-cli auth logout --json；loggedOut:true 表示注销成功 |
| bot 缺少权限 | 不要执行 auth login；引导用户在开发者后台开通 bot scope，优先复用错误里的 console_url |
| 取消用户对应用的全部服务端授权 | auth logout 只清本机登录态；服务端授权需用户在飞书授权管理页取消 |
| 只取消一个 scope | CLI 不支持单独撤销一个已授予 scope；可重新走最小 scope 授权，或让用户在授权管理页处理 |
机器读取 JSON 时，为减少 _notice 干扰，可在命令前加：
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 223 lines · 49 tokens per session scan A f176e7ade7bc
lark-shared is a skill published in the GitHub repository DropFan/claude-code-plugins (7 stars, last pushed 26d ago), licensed MIT. It adds 49 tokens to every session and 3,243 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
auto-loop
TDD-based autonomous development loop with checkpoint recovery and observability changelog.
agent-check
Validate custom agent file format and structure. Use after creating or editing an agent, before committing agent changes, or when an agent fails to load.
hook-template
Generate hook script from template. Use when adding a new hook, wiring a PreToolUse/PostToolUse/Stop/Notification hook, or scaffolding hook config for settings.json.
skill-check
Validate skill/command file format and structure. Use after creating or editing a skill, before committing skill changes, or when a skill fails to load or trigger.
agent-template
Generate custom agent from template. Use when creating a new subagent from scratch, or scaffolding an agent file with correct frontmatter.
session-relay
Continue real repository work between Claude Code, Codex CLI, and Grok Build with a privacy-bounded, drift-aware handoff packet. Use for cross-vendor takeover, context-limit checkpoints, multi-hop Claude→Codex→Grok relays, or receiving an existing Director packet. Use native resume commands for same-CLI history; never…