Lark Calendar & Tasks

What to check before installing or running this skill: - Secrets and binaries: SKILL.md and the code require FEISHU_APP_ID and FEISHU_APP_SECRET and Node.js, but the registry metadata does not list them. Do not assume no secrets are needed — you must provide an app id/secret in .secrets.env and have Node installed. Ensure the FEISHU app credentials you provide have the minimum scopes needed (calendar, task, contact read) and are for the correct tenant. - .secrets.env path: The code loads dotenv from a relative path (../../../../.secrets.env). Confirm where that resolves in your environment and that it points only to the credential file you intend to expose — avoid pointing it to a broader secrets file or repository root that contains unrelated secrets. - Unknown origin: The skill has no homepage and source is unknown. That increases the risk surface. If you plan to use it in production or with real credentials, review the source locally, run it in an isolated environment, and consider creating new FEISHU app credentials you can revoke. - Automatic attendee rule: The skill will always add the user_id 'dgg163e1' (Boyang) to every calendar event. This is documented but can be surprising. If you do not want that behavior, modify the code before use. - Dependency/install: Run npm install to satisfy 'dotenv' dependency before running scripts, and verify Node version compatibility. Consider running the scripts in a disposable container or restricted environment first. - Recommended actions: review the code locally, confirm the FEISHU app permissions, adjust the .secrets.env path if necessary, and test with non-production credentials. If you need stronger assurance, prefer an official integration or a skill with verifiable source/homepage.