SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Agent Development · Automation / AGENT SKILL
lark-skill-maker
0
Create reusable Lark CLI skills around API operations or multi-step workflows.
创建 lark-cli 的自定义 Skill。当用户需要把飞书 API 操作封装成可复用的 Skill（包装原子 API 或编排多步流程）时使用。
Understand the trade-offs.
SKILL QUALITY
Limited evidence for a verdict
50/100Provisional source score
The skill provides a clear starting workflow and template for authoring reusable lark-cli skills. An agent could draft a skill from it, but prerequisites, recovery procedures, and acceptance checks remain incomplete.
low confidenceStatic reviewInstruction skill
The reviewer had limited evidence. These scores describe what was available, not a verified measure of reliability.
What works well
- Defines the intended deliverable, naming convention, and output location.
- Provides an API discovery sequence and explicit command preference.
- Includes template sections for permissions and data transfer between steps.
Before you rely on it
- Supply the referenced shared and API exploration skills so their prerequisites and workflows can be assessed.
- Add a complete worked example with concrete commands, response fields, required scopes, and failure handling.
- Define observable acceptance checks for the generated skill, including metadata, command completeness, and workflow outcomes.
Clear instructionsCan your agent understand the task and expected outcome?
The purpose, output path, command hierarchy, and template are explicit. The boundary between a completed draft and an acceptable skill is less clear.
EVIDENCE
SKILL.md: “Skill = 一份 `SKILL.md`，教 AI 用 CLI 命令完成任务。”; “文件放在 `skills/lark-<name>/SKILL.md`：”; “优先级：Shortcut > 已注册 API > `api` 裸调。”
To improve: Specify a completion checklist that requires resolved placeholders, concrete inputs and outputs, and task-specific acceptance criteria.
Complete workflowAre prerequisites, failure cases, and recovery covered?
Provides ordered discovery steps and mentions authentication, scopes, and rollback. It does not explain setup, scope failures, or actionable recovery, and delegates prerequisites to unavailable references.
EVIDENCE
SKILL.md: “通过以上流程确定需要哪些 API、参数和 scope。”; “认证 — 说明所需 scope，登录用 `lark-cli auth login --domain <name>`”; “编排 — 说明数据传递、失败回滚、可并行步骤”
To improve: Document CLI setup and domain selection, permission-error handling, and how generated workflows should recover from partial completion or non-reversible steps.
Repeatable resultsAre examples and dependencies specific enough to repeat the work?
Concrete API discovery examples and a consistent template support repeatable drafting, but the actual generated workflow remains placeholders. CLI compatibility requirements are unspecified.
EVIDENCE
SKILL.md: “lark-cli api GET /open-apis/vc/v1/rooms --params '{"page_size":"50"}'”; “lark-cli api POST /open-apis/xxx --data '{...}'”; “# Step 2: 使用 Step 1 的 xxx_id”To improve: Include a fully populated example showing exact input values, response-field extraction, and subsequent commands; document the CLI capabilities or compatible versions it requires.
Checkable outcomesCan you tell whether the task succeeded?
A preview is suggested, but there are no defined checks, expected outputs, or worked acceptance examples for the generated skill.
EVIDENCE
SKILL.md: “安全 — 写入操作前确认用户意图，建议 `--dry-run` 预览”
To improve: Add static checks for frontmatter, references, resolved placeholders, and scope coverage, plus observable success and failure outcomes for a worked example.
Supporting filesDo the supplied scripts and references support the workflow?
The inline template is relevant and coherent, but two referenced supporting skills are unavailable. Their contents and compatibility cannot be assessed.
EVIDENCE
SKILL.md: “使用 [lark-openapi-explorer](../lark-openapi-explorer/SKILL.md)”; “先阅读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。” Supporting file contents were not supplied.
To improve: Include both referenced skills in the review bundle and provide a completed example that demonstrates their relationship to the template.
Review scope & scoring
Scores describe source evidence: 0 absent or contradicted, 1 weak, 2 incomplete, 3 solid, 4 strong. Supporting files are excluded when not applicable. Instruction skills can demonstrate quality through examples and checkable outcomes without executable tests.
- Provisional source score
- 50/100
- Files reviewed
- 1
- Source coverage
- skill only
- Reviewed
- 2026-09-30
- Rubric
- 2026-09-25-v3
- Assessed version
sha256:6c77e- Latest catalog version
sha256:6c77e
Review limitations
- Coverage is explicitly skill-only; referenced dependencies were not supplied, so confidence is low.
- This assessment uses static source evidence only. No commands were executed and runtime behavior was not established.
This review does not execute the skill or verify runtime results. Install counts and publisher reputation do not increase the score.
The full skill.
Original instructions from the publisher’s SKILL.md
# Skill Maker
基于 lark-cli 创建新 Skill。Skill = 一份 `SKILL.md`，教 AI 用 CLI 命令完成任务。
## CLI 核心能力
```bash
lark-cli <service> <resource> <method> # 已注册 API
lark-cli <service> +<verb> # Shortcut（高级封装）
lark-cli api <METHOD> <path> [--data/--params] # 任意飞书 OpenAPI
lark-cli schema <service.resource.method> # 查参数定义
```
优先级：Shortcut > 已注册 API > `api` 裸调。
## 调研 API
```bash
# 1. 查看已有的 API 资源和 Shortcut
lark-cli <service> --help
# 2. 查参数定义
lark-cli schema <service.resource.method>
# 3. 未注册的 API，用 api 直接调用
lark-cli api GET /open-apis/vc/v1/rooms --params '{"page_size":"50"}'
lark-cli api POST /open-apis/vc/v1/rooms/search --data '{"query":"5F"}'
```
如果以上命令无法覆盖需求（CLI 没有对应的已注册 API 或 Shortcut），使用 [lark-openapi-explorer](../lark-openapi-explorer/SKILL.md) 从飞书官方文档库逐层挖掘原生 OpenAPI 接口，获取完整的方法、路径、参数和权限信息，再通过 `lark-cli api` 裸调完成任务。
通过以上流程确定需要哪些 API、参数和 scope。
## SKILL.md 模板
文件放在 `skills/lark-<name>/SKILL.md`：
```markdown
---
name: lark-<name>
version: 1.0.0
description: "<功能描述>。当用户需要<触发场景>时使用。"
metadata:
requires:
bins: ["lark-cli"]
---
# <标题>
> **前置条件：** 先阅读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。
## 命令
\```bash
# 单步操作
lark-cli api POST /open-apis/xxx --data '{...}'
# 多步编排：说明步骤间数据传递
# Step 1: ...（记录返回的 xxx_id）
# Step 2: 使用 Step 1 的 xxx_id
\```
## 权限
| 操作 | 所需 scope |
|------|-----------|
| xxx | `scope:name` |
```
## 关键原则
- **description 决定触发** — 包含功能关键词 + "当用户需要...时使用"
- **认证** — 说明所需 scope，登录用 `lark-cli auth login --domain <name>`
- **安全** — 写入操作前确认用户意图，建议 `--dry-run` 预览
- **编排** — 说明数据传递、失败回滚、可并行步骤