Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/foxzool/openlark/openlark-code-standardsnpx skills add foxzool/openlark --skill openlark-code-standardsgit clone --depth 1 https://github.com/foxzool/openlarkWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00110 | $0.03376 |
| Opus 5 | $0.00055 | $0.01688 |
| Sonnet 5 | $0.00022 | $0.00675 |
| Haiku 4.5 | $0.00011 | $0.00338 |
Grade A, and why
openlark-code-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 163 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OpenLark 代码规范检查（Skill）
适用场景
- 用户要求“检查项目代码规范”
- 新增 API 前想确认实现套路是否一致
- 评审 PR 时需要快速验证是否遵循 OpenLark 既有约定
- 发现模块风格漂移，想做一次统一体检
目标
输出一份可落地的规范检查结果，包含：
- 规范结论（通过/风险）
- 规则-证据对（每条规则附
path:line） - 风险分级（P0/P1/P2）
- 新 API 最小检查清单（可直接用于 PR Review）
检查范围
覆盖全部 crates/openlark-*（按 AGENTS.md#STRUCTURE 有 18 个业务/基础设施 crate）。
- 重点核审：核心基础设施（
openlark-core、openlark-client、openlark-protocol）与高频业务 crate（openlark-docs、openlark-communication、openlark-hr）。 - Client 命名（
XxxClient）权威映射表见docs/CLIENT_NAMING_CONVENTION.md的「当前映射」，命名核审以此为准。 - 可按参数缩小为某个 crate 或目录（如
openlark-mail、crates/openlark-hr/src/）。
核心检查项
1) API 实现套路一致性
- 是否使用
Request/Response + Builder模式 - 是否提供
execute()与execute_with_options(RequestOption) - 是否通过
Transport::request(...)发送请求
🔴 硬规则（grep 命中即 P0 违规）：
- 业务 crate（除
openlark-core与openlark-webhook）不得出现reqwest::Client::new()——一旦命中，说明有端点绕过了Transport，必为不一致源头。检查命令：rg "reqwest::Client::new" crates/ --type rust -g '!openlark-core/**' -g '!openlark-webhook/**' - 白名单说明：
openlark-webhook是有意例外——自定义机器人不是飞书开放平台 API（目标 URL 为用户配置的绝对地址、用 URL 携带签名密钥鉴权、响应体为非标准{code,msg}），不适用Transport的/open-apis/基址与 token 注入，故保留独立 reqwest 路径（见 issue #214 调研结论，注释位于crates/openlark-webhook/src/robot/v1/send.rs:13-26）。勿改 webhook 的 reqwest 用法。 - 不得手工
Authorization头 /get_app_token（token 由Transport自动注入） Service/Request不得持有 HTTP client 字段（只持Config）
🟡 R 语义检查（防止双重嵌套陷阱）：
ApiRequest<R>的R应是响应data字段的内容类型，不是外层包装。- 可疑信号：某个
XxxResponsestruct 带data: Option<...>字段、同时又作为ApiRequest<XxxResponse>的泛型——大概率双重嵌套（core 已把R当作 data 内容解析）。 - 详细契约见
Skill(openlark-api)的"🔒 核心契约"。
2) 端点定义规范
- 是否使用 per-crate 类型安全端点枚举：每个 crate 在
src/common/api_endpoints.rs定义各自的<Domain>ApiV1枚举，并实现pub fn to_url(&self) -> String（注意to_url()返回的是相对路径String，形如/open-apis/mail/v1/...，不带基址）。 - 是否避免手写业务 URL（统一走枚举
to_url()） - 命名注意：枚举名是
<Domain>ApiV1，Domain通常但并非总是等于 crate 名——以现况为准：- 与 crate 同名：
MailApiV1（crates/openlark-mail/src/common/api_endpoints.rs:5）、DocsApiV1（crates/openlark-docs/src/common/api_endpoints.rs:440）、HelpdeskApiV1、AppApiV1（application）。 - 与 crate 名不同：
VcApiV1（meeting，crates/openlark-meeting/src/common/api_endpoints.rs:224）、TaskApiV1/BoardApiV1（workflow）、AdminApiV1（platform）、AuthenApiV1（auth）、HR 多枚举（AttendanceApiV1/HireApiV1/OkrApiV1/...）、Docs 多枚举（BitableApiV1/WikiApiV1/DocxApiV1/MinutesApiV1/...）。
- 与 crate 同名：
- 新增端点时改枚举与
to_url()match 分支，不要在 Request/Builder 里手写 URL 字面量。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 163 lines · 0 tokens per session scan A 1336eaa06ce0
openlark-code-standards is a skill published in the GitHub repository foxzool/openlark (105 stars, last pushed 5d ago), licensed Apache-2.0. It adds 110 tokens to every session and 3,376 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lark-cli
Lark/Feishu CLI skills for Stella sessions. Covers workspace operations — calendar, docs, tasks, mail, and messenger — via the Stella-managed lark-cli tool. Stella installs the binary and injects a managed per-user OAuth token; no native CLI bootstrap is required. Always read lark-shared first for identity selection…
doubao-tts
Generate high-quality speech audio using Doubao (豆包/Volcengine) TTS API. Use this skill when the user asks to generate audio, podcasts, voiceovers, or text-to-speech output.
metaschedule
MetaBot's persistent server-side scheduler (cron + one-shot). Optional skill — not installed by default. Use when the user wants tasks that survive Claude session restarts, are visible to other bots, or need to run in MetaBot's PM2 process rather than this Claude session.
metabot-team
Use for the MetaBot Agent Teams CLI: create and inspect durable Teams, spawn teammates, exchange messages, and manage Tasks and Runs across Sessions.
metabot
Unified MetaBot CLI for personal Memory, Skill Hub, agent registry and inbox relay, Agent Teams, T5T, scheduling, and bridge runtime operations.
larksnap-fetch
把飞书/Lark 文档或普通网页抓取并保存到本地，也能编辑用户有权限的飞书文档，并用已登录浏览器执行一次网页搜索。用户要求下载、导出、抓取、写入飞书文档，或联网搜索资料/参考链接时使用本技能，即使没有提到 larksnap。底层通过技能自带 daemon 桥接已登录的 larksnap 浏览器扩展；arXiv 使用独立脚本。.