Borrowing it
Nothing to install: this file belongs to foxzool/openlark. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/foxzool/openlark/main/.agents/skills/openlark-api-field-verify/SKILL.mdgit clone --depth 1 https://github.com/foxzool/openlarkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/foxzool/openlark/openlark-api-field-verify)<a href="https://agentmods.dev/skills/foxzool/openlark/openlark-api-field-verify"><img src="https://agentmods.dev/badge/skills/foxzool/openlark/openlark-api-field-verify/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/foxzool/openlark/openlark-api-field-verify"><img src="https://agentmods.dev/badge/skills/foxzool/openlark/openlark-api-field-verify.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 96 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 243 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 269 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00129 | $0.04397 |
| Opus 5.5 | $0.00052 | $0.01759 |
| Sonnet 5.5 | $0.00026 | $0.00879 |
| Haiku 4.5 | $0.00013 | $0.00440 |
Grade A, and why
openlark-api-field-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 311 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenLark API 字段核对技能
🧭 技能路由指南
本技能适用场景：
- 实现前/后读取飞书官方文档字段（本仓库唯一可靠的文档抓取入口）
- 新增/重构飞书 API 后，核对请求体/响应体字段是否与官方文档一致
- 怀疑某个 API 的字段是"推断"而非来自真实文档（如参照同族接口复制）
- 用户级（user_access_token）接口的字段核对（这类接口字段常与应用级不同）
fetch_docpath.py在线抓取失败（返回占位文本），需要替代方案
其他技能：
- 添加/重构 API 的实现规范 →
Skill(openlark-api)（读文档后回此技能核对，或实现时先来此抓取） - 统计 API 覆盖率/缺失清单 →
Skill(openlark-api-validation) - 代码规范、风格一致性 →
Skill(openlark-code-standards)
关键词触发映射
- 字段核对、字段验证、字段不符、文档核对、核对请求字段、核对响应字段、飞书文档、playwright 抓文档 →
openlark-api-field-verify - 新增 API、重构 API、Builder、Request/Response →
openlark-api - 覆盖率、缺失 API、CSV 对比 →
openlark-api-validation
双向跳转规则
openlark-api需要读文档时必须来本技能（勿用fetch_docpath.py在线抓取）- 若核对发现字段不符需要修正实现，转
openlark-api落地修正 - 若核对发现是 API 尚未实现，转
openlark-api补齐 - 若核对根源是覆盖率脚本误报，转
openlark-api-validation
🎯 技能用途
飞书开放平台文档是 SPA（单页应用），内容靠 JS 动态渲染。常见的抓取方式各有局限：
| 方式 | 问题 |
|---|---|
fetch_docpath.py（项目 skill 脚本） |
对新接口常返回占位文本，抓不到字段表 |
| 直接 HTTP 请求文档 URL | 只拿到 SPA 外壳，正文为空 |
| web reader / 搜索引擎 | 新接口搜不到，SPA 抓不到 |
两条可靠通道（按成本选）：
.md源（首选，零渲染成本）：https://open.feishu.cn<fullPath>.md（CSV 的fullPath原样拼接）。SPA 页面 head 里 link alternate 指向的 markdown 源，含完整字段表与请求/响应示例。get_detail 返回 41404 / structure_incomplete 的 API（约 47 个）文档网页仍活着，.md全部可取——这正是 evidence 管线的自动回退通道（_needs_markdown_fallback）。- playwright 渲染（备用）：
.md拿不到或需要 innerText 形态时用本技能的fetch_doc.js真实渲染页面提取字段表。
📋 核心工作流
第 0 步：判断是否需要核对
以下情况必须核对（字段易错）：
- ✅ 用户级（user_access_token）接口 —— 字段常与应用级不同（无 user_id，从 token 推断）
- ✅ 参照"同族接口"复制的实现 —— 字段名/结构可能已变
- ✅ 新上的飞书接口 —— 文档可能尚未被旧脚本收录
- ✅ 请求体有数组/嵌套对象的接口 —— 上限、子字段易漏
以下情况可跳过：
- ⏭️ 直接照抄飞书官方 JSON 示例实现的（已有真实样本）
- ⏭️ 仅改端点 URL、字段未动的重构
第 1 步：找到正确的文档 URL
这是最易错的一步。 URL 唯一权威源是 CSV 的 fullPath：
canonical_url = "https://open.feishu.cn" + fullPath
| 来源 | 是否可用 | 说明 |
|---|---|---|
fullPath |
✅ 唯一权威 | 原样拼接，不要改路径格式 |
docPath |
❌ 默认勿用 | 常与 fullPath 不一致（大量 server-docs vs 实际路径） |
手拼 /reference/... 或 /server-docs/... |
❌ 禁止 | 易 404："The documentation could not be found." |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +3 lines 633091afcce9
- 2mo ago First seen · 308 lines · 129 tokens per session scan A e3954d9a3deb
openlark-api-field-verify is a skill published in the GitHub repository foxzool/openlark (108 stars, last pushed 3d ago), licensed Apache-2.0. It adds 129 tokens to every session and 4,397 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lark-openapi-explorer
A skill for finding and calling Feishu/Lark OpenAPI endpoints that are not covered by existing skills or registered commands. OpenAPI is the documented interface that software uses to access a service.
anycross-creator
Build, validate, and package AnyCross workflow files (the Lark/Feishu automation platform) — produces an importable .zip via a Python generator script. Covers the real flow.json schema (structure/steps, operation objects, the four spel types), connector/operation IDs harvested from verified exports, LarkBase field…
wecom-integration
A shared integration guide for WeCom, a business messaging and workplace platform, including login, browser-side setup, tokens, and user authentication.
chat-viewer
A design for displaying WeCom chat records. WeCom is an enterprise messaging platform; the service syncs and decrypts messages, downloads media, and can turn voice messages into text.
fastapi-common
A shared foundation for FastAPI web backends, covering cross-origin access, error handling, request logs, and consistent API responses. FastAPI is a Python framework for building web APIs.
websocket-realtime
A FastAPI WebSocket setup for two-way, real-time communication between a server and connected clients. WebSockets keep a connection open so updates can be sent without repeated requests.