This skill guides you on how to operate Feishu resources through lark-cli, and what precautions there are.
Configuration initialization
First-time use requires running lark-cli config init to complete application configuration.
When you help the user initialize the configuration, use the background method with the following command to start the application configuration process. After starting, read the output, extract the authorization link from it, and send it to the user:
# 发起配置（该命令会阻塞直到用户打开链接并完成操作或过期）
lark-cli config init --new
Authentication
Identity types
Two identity types, switched via --as :
| Identity | Identifier | How to obtain | Applicable scenarios |
|---|---|---|---|
| user identity | --as user |
lark-cli auth login , etc. |
Access the user's own resources (calendar, cloud space, etc.) |
| bot application identity | --as bot |
Automatic, only requires appId + appSecret | Application-level operations, access the bot's own resources |
Identity selection principles
The output [identity: bot/user] represents the current identity. bot and user behave very differently, so you need to confirm the identity matches the target requirements:
- Bot cannot see user resources: Cannot access the user's personal resources such as calendar, cloud space documents, mailbox, etc. For example,
--as botquerying schedules returns the bot's own (empty) calendar - Bot cannot act on behalf of the user: Messages are sent in the application's name, and created documents belong to the bot
- Bot permissions: Only need to enable scopes in the Feishu Developer Console, no need for
auth login - User permissions: Enable scopes in the console + the user authorizes via
auth login. Both layers must be satisfied
Handling insufficient permissions
When encountering permission-related errors,adopt different solutions according to the current identity type。
The error response contains key information:
permission_violations: Lists the missing scopes (choose 1 from N)console_url: Link to the permission configuration in the Feishu Developer Consolehint: Suggested fix command
Bot identity (--as bot）
Provide the console_url from the error to the user, and guide them to enable the scope in the console.Prohibitedto execute on the bot auth login。
User identity (--as user）
lark-cli auth login --domain <domain> # 按业务域授权
lark-cli auth login --scope "<missing_scope>" # 按具体 scope 授权（推荐,符合最小权限原则）
Rule: auth login must specify a scope (--domain or --scope). The scopes of multiple logins accumulate (incremental authorization).
Agent-initiated authentication (recommended)
When you, as an AI agent, need to help the user complete authentication, use the background method to execute the following command to start the authorization process, and send the authorization link to the user:
# 发起授权（阻塞直到用户授权完成或过期）
lark-cli auth login --scope "calendar:calendar:readonly"
Update check
After a lark-cli command is executed, if a new version is detected, the JSON output will include the _notice.update field (containing message、command , etc.).
When you see _notice.update in the output, after completing the user's current request, proactively offer to help the user update：
- Inform the user of the current version and the latest version number
- Propose executing the update (CLI and Skills need to be updated at the same time):
npm update -g @larksuite/cli && npx skills add larksuite/cli -g -y - After the update is complete, remind the user:Exit and reopen AI Agentto load the latest Skills
Rule: Do not silently ignore update prompts. Even if the current task is unrelated to the update, you should still inform the user after completing their request.
Security rules
- Do not output keys(appSecret, accessToken) in plaintext to the terminal.
- Before write/delete operations, you must confirm the user's intent。
- Use
--dry-runto preview dangerous requests.