Determine the intent first, then read the corresponding workflow. Do not load all references at once.
After loading, resolve the references/、scripts/、templates/、examples/ relative paths in the workflow according to that
workflow.md directory; when executing scripts, use the resolved actual paths, and do not rely on the current shell directory.
Routing
| Intent | Read file |
|---|---|
Login, logout, scope preflight, diagnostics for scopes already enabled for the app (auth scopes)、Token、profile、config、doctor、skill installation/drift (skills)、CLI upgrade (update) |
references/workflows/auth/workflow.md |
Call any OpenAPI,--as, pagination and dry-run |
references/workflows/api/workflow.md |
| Query local OpenAPI path, parameters and scopes | references/workflows/schema/workflow.md |
Global document search (including drive search filtered by folder/knowledge base/creator), messages or apps |
references/workflows/search/workflow.md |
Query users, emails, phone numbers, departments, search bots (user search-bot) |
references/workflows/directory/workflow.md |
When identity selection is involved, or when encountering Token, identity, or scope errors (such as 99991663/99991668/99991672/99991679), read references/workflows/auth/references/identity.md, see the troubleshooting table at references/workflows/auth/workflow.md;auth check is not a Bot permission check.
When determining command success or failure, writing scripts, or encountering exit code 10 (confirmation required), read references/workflows/auth/references/agent-contract.md。
Schema is only responsible for discovering interfaces; API is responsible for executing requests. Usually query the schema first, then call api.
Execution rules
- For repository development, prefer using the just-compiled
bin/feishu-cli(make build) or./feishu-cli; for installed environments, use thefeishu-cliin PATH. When the skill and CLI versions are inconsistent (commands or flags do not match), use--helpas the standard, and usefeishu-cli skills read <技能> <相对路径>to read the documentation matching the current binary; each command's--helpwill list related skills and workflows at the end. - Determine the execution identity first.
auth check --scopeonly checks the local User Token of the current profile, and cannot verify Bot permissions or explicit Tokens; whether the app side has enabled it (distinguishing 99991672 app not enabled from 99991679 user not authorized) useauth scopes --scope, whether the Bot can access a specific resource is subject to the actual interface result. Do not echo the real Token. - For multiple Bots / when unsure of the current app, first
profile list --json; for a single use,--profile <name>, without changing the default pointer. When environment variables override the target App, reuse the existing authorization to remove the corresponding override in this process, or use--bot-app-id/--bot-app-secretto specify the correct credentials, without modifying the user's global environment. apiAll write requests can first be previewed locally with the CLI--dry-run; the preview does not mean the server will accept it. For other commands, choose the verification method according to their respective help.- Search and contacts results are read-only by default; when the user requests subsequent write operations, switch to the corresponding domain Skill.
- Exit codes, confirmation gates (exit code 10 requires user consent before appending
--yes)、stdout/stderr conventions and target entity resolution seereferences/workflows/auth/references/agent-contract.md。
Domain boundaries
- Document reading/writing and import/export:
feishu-cli-docs - Drive, knowledge base, comments and permissions:
feishu-cli-storage - Messages, group chats, cards and events:
feishu-cli-messaging - Sheet/Bitable:
feishu-cli-data - Whiteboards, Slides, HTMLBox and Miaoda apps:
feishu-cli-visual - Calendar, tasks, approvals, attendance and OKR:
feishu-cli-work - Feishu Mail:
feishu-cli-mail - Video Conferencing and Minutes:
feishu-cli-meetings
To check the schema or use api When passing through unencapsulated endpoints, even if the endpoint belongs to the above business domains, keep it in this Skill; the business command itself is handed over to the corresponding domain Skill.