Borrowing it
Nothing to install: this file belongs to foxzool/openlark. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/foxzool/openlark/main/.agents/skills/openlark-code-standards/SKILL.mdgit clone --depth 1 https://github.com/foxzool/openlarkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/foxzool/openlark/openlark-code-standards)<a href="https://agentmods.dev/skills/foxzool/openlark/openlark-code-standards"><img src="https://agentmods.dev/badge/skills/foxzool/openlark/openlark-code-standards/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/foxzool/openlark/openlark-code-standards"><img src="https://agentmods.dev/badge/skills/foxzool/openlark/openlark-code-standards.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.03376 |
| Opus 5.5 | $0.00000 | $0.01350 |
| Sonnet 5.5 | $0.00000 | $0.00675 |
| Haiku 4.5 | $0.00000 | $0.00338 |
Grade A, and why
openlark-code-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenLark 代码规范检查(Skill)
适用场景
- 用户要求“检查项目代码规范”
- 新增 API 前想确认实现套路是否一致
- 评审 PR 时需要快速验证是否遵循 OpenLark 既有约定
- 发现模块风格漂移,想做一次统一体检
目标
输出一份可落地的规范检查结果,包含:
- 规范结论(通过/风险)
- 规则-证据对(每条规则附
path:line) - 风险分级(P0/P1/P2)
- 新 API 最小检查清单(可直接用于 PR Review)
检查范围
覆盖全部 crates/openlark-*(按 AGENTS.md#STRUCTURE 有 18 个业务/基础设施 crate)。
- 重点核审:核心基础设施(
openlark-core、openlark-client、openlark-protocol)与高频业务 crate(openlark-docs、openlark-communication、openlark-hr)。 - Client 命名(
XxxClient)权威映射表见docs/CLIENT_NAMING_CONVENTION.md的「当前映射」,命名核审以此为准。 - 可按参数缩小为某个 crate 或目录(如
openlark-mail、crates/openlark-hr/src/)。
核心检查项
1) API 实现套路一致性
- 是否使用
Request/Response + Builder模式 - 是否提供
execute()与execute_with_options(RequestOption) - 是否通过
Transport::request(...)发送请求
🔴 硬规则(grep 命中即 P0 违规):
- 业务 crate(除
openlark-core与openlark-webhook)不得出现reqwest::Client::new()——一旦命中,说明有端点绕过了Transport,必为不一致源头。检查命令:rg "reqwest::Client::new" crates/ --type rust -g '!openlark-core/**' -g '!openlark-webhook/**' - 白名单说明:
openlark-webhook是有意例外——自定义机器人不是飞书开放平台 API(目标 URL 为用户配置的绝对地址、用 URL 携带签名密钥鉴权、响应体为非标准{code,msg}),不适用Transport的/open-apis/基址与 token 注入,故保留独立 reqwest 路径(见 issue #214 调研结论,注释位于crates/openlark-webhook/src/robot/v1/send.rs:13-26)。勿改 webhook 的 reqwest 用法。 - 不得手工
Authorization头 /get_app_token(token 由Transport自动注入) Service/Request不得持有 HTTP client 字段(只持Config)
🟡 R 语义检查(防止双重嵌套陷阱):
ApiRequest<R>的R应是响应data字段的内容类型,不是外层包装。- 可疑信号:某个
XxxResponsestruct 带data: Option<...>字段、同时又作为ApiRequest<XxxResponse>的泛型——大概率双重嵌套(core 已把R当作 data 内容解析)。 - 详细契约见
Skill(openlark-api)的"🔒 核心契约"。
2) 端点定义规范
- 是否使用 per-crate 类型安全端点枚举:每个 crate 在
src/common/api_endpoints.rs定义各自的<Domain>ApiV1枚举,并实现pub fn to_url(&self) -> String(注意to_url()返回的是相对路径String,形如/open-apis/mail/v1/...,不带基址)。 - 是否避免手写业务 URL(统一走枚举
to_url()) - 命名注意:枚举名是
<Domain>ApiV1,Domain通常但并非总是等于 crate 名——以现况为准:- 与 crate 同名:
MailApiV1(crates/openlark-mail/src/common/api_endpoints.rs:5)、DocsApiV1(crates/openlark-docs/src/common/api_endpoints.rs:440)、HelpdeskApiV1、AppApiV1(application)。 - 与 crate 名不同:
VcApiV1(meeting,crates/openlark-meeting/src/common/api_endpoints.rs:224)、TaskApiV1/BoardApiV1(workflow)、AdminApiV1(platform)、AuthenApiV1(auth)、HR 多枚举(AttendanceApiV1/HireApiV1/OkrApiV1/...)、Docs 多枚举(BitableApiV1/WikiApiV1/DocxApiV1/MinutesApiV1/...)。
- 与 crate 同名:
- 新增端点时改枚举与
to_url()match 分支,不要在 Request/Builder 里手写 URL 字面量。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 163 lines · 0 tokens per session scan A 1336eaa06ce0
openlark-code-standards is a skill published in the GitHub repository foxzool/openlark (108 stars, last pushed 3d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 3,376 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
openviking-memory
Search and save shared project decisions, conventions and user preferences in OpenViking when the task needs history missing from this conversation.
metaschedule
MetaBot's persistent server-side scheduler (cron + one-shot). Optional skill — not installed by default. Use when the user wants tasks that survive Claude session restarts, are visible to other bots, or need to run in MetaBot's PM2 process rather than this Claude session.
metabot-team
Use for the MetaBot Agent Teams CLI: create and inspect durable Teams, spawn teammates, exchange messages, and manage Tasks and Runs across Sessions.
metabot
Unified MetaBot CLI for personal Memory, Skill Hub, durable Agent Bus messaging, agent registry, Agent Teams, T5T, scheduling, and bridge runtime operations.
metaskill
The meta-skill: create AI agent teams, individual agents, or custom skills for any project. Use when the user wants to generate a complete agent team, create a single agent, or create a single skill for Claude Code, Kimi, or Codex.
larksnap-fetch
A bridge for downloading Feishu/Lark documents or ordinary webpages into local files, with options such as Markdown, HTML, or PDF. Feishu, also called Lark, is a workplace collaboration platform.