Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yokingma/weclaws --skill lark-sharedgit clone --depth 1 https://github.com/yokingma/weclawsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yokingma/weclaws/lark-shared)<a href="https://agentmods.dev/skills/yokingma/weclaws/lark-shared"><img src="https://agentmods.dev/badge/skills/yokingma/weclaws/lark-shared/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yokingma/weclaws/lark-shared"><img src="https://agentmods.dev/badge/skills/yokingma/weclaws/lark-shared.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.01627 |
| Opus 5.5 | $0.00019 | $0.00651 |
| Sonnet 5.5 | $0.00010 | $0.00325 |
| Haiku 4.5 | $0.00005 | $0.00163 |
Grade A, and why
lark-shared scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
91% identical to lark-shared — 1 line differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
lark-cli 共享规则
本技能指导你如何通过lark-cli操作飞书资源, 以及有哪些注意事项。
配置初始化
首次使用需运行 lark-cli config init 完成应用配置。
当你帮用户初始化配置时，使用background方式使用下面的命令发起配置应用流程，启动后读取输出，从中提取授权链接并发给用户。
URL 转发规则：当命令输出 verification_url、verification_uri_complete、console_url 等 URL 字段时，必须将 URL exactly as returned by the CLI 转发给用户，并把它视为不可修改的 opaque string；不要做 URL encode/decode，不要补 %20、空格或标点，不要重新拼接 query，不要改写成 Markdown link text，建议用只包含原始 URL 的代码块单独输出。
# 发起配置（该命令会阻塞直到用户打开链接并完成操作或过期）
lark-cli config init --new
认证
身份类型
两种身份类型，通过 --as 切换：
| 身份 | 标识 | 获取方式 | 适用场景 |
|---|---|---|---|
| user 用户身份 | --as user |
lark-cli auth login 等 |
访问用户自己的资源（日历、云空间等） |
| bot 应用身份 | --as bot |
自动，只需 appId + appSecret | 应用级操作,访问bot自己的资源 |
身份选择原则
输出的 [identity: bot/user] 代表当前身份。bot 与 user 表现差异很大，需确认身份符合目标需求：
- Bot 看不到用户资源：无法访问用户的日历、云空间文档、邮箱等个人资源。例如
--as bot查日程返回 bot 自己的（空）日历 - Bot 无法代表用户操作：发消息以应用名义发送，创建文档归属 bot
- Bot 权限：只需在飞书开发者后台开通 scope，无需
auth login - User 权限：后台开通 scope + 用户通过
auth login授权，两层都要满足
权限不足处理
遇到权限相关错误时，根据当前身份类型采取不同解决方案。
错误响应中包含关键信息：
permission_violations：列出缺失的 scope (N选1)console_url：飞书开发者后台的权限配置链接hint：建议的修复命令
Bot 身份（--as bot）
将错误中的 console_url 原样提供给用户，引导去后台开通 scope。禁止对 bot 执行 auth login。
User 身份（--as user）
lark-cli auth login --domain <domain> # 按业务域授权
lark-cli auth login --scope "<missing_scope>" # 按具体 scope 授权（推荐,符合最小权限原则）
规则：auth login 必须指定范围（--domain 或 --scope）。多次 login 的 scope 会累积（增量授权）。
Agent 代理发起认证（推荐）
当你作为 AI agent 需要帮用户完成认证时，使用background方式 执行以下命令发起授权流程, 并将授权链接原样发给用户：
# 发起授权（阻塞直到用户授权完成或过期）
lark-cli auth login --scope "calendar:calendar:readonly"
更新检查
lark-cli 命令执行后，如果检测到新版本，JSON 输出中会包含 _notice.update 字段（含 message、command 等）。
当你在输出中看到 _notice.update 时，完成用户当前请求后，主动提议帮用户更新：
- 告知用户当前版本和最新版本号
- 提议执行更新（同时更新 CLI 和 Skills）：
lark-cli update - 更新完成后提醒用户：退出并重新打开 AI Agent 以加载最新 Skills
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 139 lines · 48 tokens per session scan A 732465dba8c1
lark-shared is a skill published in the GitHub repository yokingma/weclaws (51 stars, last pushed 1mo ago), licensed MIT. It adds 48 tokens to every session and 1,627 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 91% identical to lark-shared, differing in 1 line, and is treated as a copy.
Other skills, from other repositories
wxjava-api-contributor
A contributor guide for adding or maintaining official WeChat API support in WxJava, a Java software development kit. It covers services, request and response data objects, data conversion, HTTP handling, starter configuration, and regression tests.
wxjava-module-selector
A decision guide for choosing the correct WxJava Maven module, dependency management file, and example for a WeChat use case. WxJava is a Java software development kit for services such as official accounts, mini programs, and payments.
wxjava-troubleshooter
A troubleshooting guide for WxJava, a Java library used to connect applications to WeChat services. It organizes problems involving setup, access tokens, signatures, payment certificates, callbacks, data conversion, network requests, and multiple accounts.
wxjava-upgrade-guide
A migration guide for upgrading WxJava, a Java software development kit for WeChat services, from one version or dependency setup to another. It checks dependencies, Java versions, configuration, HTTP clients, and public programming interfaces.
capabilities
Your capability catalog — read this at boot. Lists the temporal date-range skills and the external integrations (reached via the loopback broker) available to you as a spawned worker, and exactly how to call each. Read-only. Consult it whenever you're unsure what tools/integrations you have or how to invoke them.
wxjava-integration-guide
A setup guide for connecting Java, Spring Boot, or Solon applications to WxJava, a Java software development kit for WeChat services. It covers choosing modules, adding dependencies, configuring accounts, and making an initial API call.