Borrowing it
Nothing to install: this file belongs to foxzool/openlark. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/foxzool/openlark/main/.agents/skills/openlark-api-field-verify/SKILL.mdgit clone --depth 1 https://github.com/foxzool/openlarkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/foxzool/openlark/openlark-api-field-verify)<a href="https://agentmods.dev/skills/foxzool/openlark/openlark-api-field-verify"><img src="https://agentmods.dev/badge/skills/foxzool/openlark/openlark-api-field-verify.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00129 | $0.04252 |
| Opus 5 | $0.00064 | $0.02126 |
| Sonnet 5 | $0.00026 | $0.00850 |
| Haiku 4.5 | $0.00013 | $0.00425 |
Grade A, and why
openlark-api-field-verify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 308 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenLark API 字段核对技能
🧭 技能路由指南
本技能适用场景：
- 实现前/后读取飞书官方文档字段（本仓库唯一可靠的文档抓取入口）
- 新增/重构飞书 API 后，核对请求体/响应体字段是否与官方文档一致
- 怀疑某个 API 的字段是"推断"而非来自真实文档（如参照同族接口复制）
- 用户级（user_access_token）接口的字段核对（这类接口字段常与应用级不同）
fetch_docpath.py在线抓取失败（返回占位文本），需要替代方案
其他技能：
- 添加/重构 API 的实现规范 →
Skill(openlark-api)（读文档后回此技能核对，或实现时先来此抓取） - 统计 API 覆盖率/缺失清单 →
Skill(openlark-api-validation) - 代码规范、风格一致性 →
Skill(openlark-code-standards)
关键词触发映射
- 字段核对、字段验证、字段不符、文档核对、核对请求字段、核对响应字段、飞书文档、playwright 抓文档 →
openlark-api-field-verify - 新增 API、重构 API、Builder、Request/Response →
openlark-api - 覆盖率、缺失 API、CSV 对比 →
openlark-api-validation
双向跳转规则
openlark-api需要读文档时必须来本技能（勿用fetch_docpath.py在线抓取）- 若核对发现字段不符需要修正实现，转
openlark-api落地修正 - 若核对发现是 API 尚未实现，转
openlark-api补齐 - 若核对根源是覆盖率脚本误报，转
openlark-api-validation
🎯 技能用途
飞书开放平台文档是 SPA（单页应用），内容靠 JS 动态渲染。常见的两种抓取方式各有局限：
| 方式 | 问题 |
|---|---|
fetch_docpath.py（项目 skill 脚本） |
对新接口常返回占位文本，抓不到字段表 |
| 直接 HTTP 请求文档 URL | 只拿到 SPA 外壳，正文为空 |
| web reader / 搜索引擎 | 新接口搜不到，SPA 抓不到 |
本技能用 playwright 真实渲染页面，等待 JS 执行后提取 innerText，拿到完整的字段表。这是目前唯一可靠的方式。
📋 核心工作流
第 0 步：判断是否需要核对
以下情况必须核对（字段易错）：
- ✅ 用户级（user_access_token）接口 —— 字段常与应用级不同（无 user_id，从 token 推断）
- ✅ 参照"同族接口"复制的实现 —— 字段名/结构可能已变
- ✅ 新上的飞书接口 —— 文档可能尚未被旧脚本收录
- ✅ 请求体有数组/嵌套对象的接口 —— 上限、子字段易漏
以下情况可跳过：
- ⏭️ 直接照抄飞书官方 JSON 示例实现的（已有真实样本）
- ⏭️ 仅改端点 URL、字段未动的重构
第 1 步：找到正确的文档 URL
这是最易错的一步。 URL 唯一权威源是 CSV 的 fullPath：
canonical_url = "https://open.feishu.cn" + fullPath
| 来源 | 是否可用 | 说明 |
|---|---|---|
fullPath |
✅ 唯一权威 | 原样拼接，不要改路径格式 |
docPath |
❌ 默认勿用 | 常与 fullPath 不一致（大量 server-docs vs 实际路径） |
手拼 /reference/... 或 /server-docs/... |
❌ 禁止 | 易 404："The documentation could not be found." |
# 从 CSV 用 api id 或 url 反查 fullPath
python3 -c "
import csv
with open('api_list_export.csv', encoding='utf-8-sig') as f:
for row in csv.DictReader(f):
if row['id'] == '7642253323628383198' or 'approval/v4/tasks/pass' in row['url']:
print(row['fullPath'])
"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 308 lines · 129 tokens per session scan A e3954d9a3deb
openlark-api-field-verify is a skill published in the GitHub repository foxzool/openlark (105 stars, last pushed 4d ago), licensed Apache-2.0. It adds 129 tokens to every session and 4,252 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lark-openapi-explorer
A skill for finding and calling Feishu/Lark OpenAPI endpoints that are not covered by existing skills or registered commands. OpenAPI is the documented interface that software uses to access a service.
lark-cli
Lark/Feishu CLI skills for Stella sessions. Covers workspace operations — calendar, docs, tasks, mail, and messenger — via the Stella-managed lark-cli tool. Stella installs the binary and injects a managed per-user OAuth token; no native CLI bootstrap is required. Always read lark-shared first for identity selection…
wecom-integration
A shared integration guide for WeCom, a business messaging and workplace platform, including login, browser-side setup, tokens, and user authentication.
chat-viewer
A design for displaying WeCom chat records. WeCom is an enterprise messaging platform; the service syncs and decrypts messages, downloads media, and can turn voice messages into text.
data-export
A backend service for exporting data in Excel, CSV, or JSON while tracking each export as a background task.
dingtalk-integration
A guide for sending DingTalk group-robot messages through webhooks. DingTalk is a workplace messaging platform, and a webhook is a URL that accepts automated messages.