Feishu Agent

Feishu (Lark) CLI agent - Provides calendar, todo, and contact management capabilities for AI assistants

Security Scan

The skill's requirements and runtime instructions are consistent with a Feishu (Lark) CLI for calendar/todo/contact management, but there are a few minor metadata and operational notes you should review before installing.

Purpose & Capability

Name/description (Feishu CLI for calendar, todo, contacts) align with the instructions: interactive setup, OAuth, reading/writing calendar/todo/contact data. The only declared binary dependency is 'bun', which matches the TypeScript/Node/bun-based workflow described.

Instruction Scope

Instructions are scoped to the stated purpose: they prompt for App ID/Secret, perform OAuth (opening a browser), and save tokens to ~/.feishu-agent/config.json. They do not instruct reading unrelated system files or exfiltrating data to unknown endpoints. Note: the skill stores sensitive tokens and secrets in a home-directory JSON file (explicitly documented), which is expected for a CLI but should be considered sensitive.

Install Mechanism

This is an instruction-only skill (no install spec or embedded code). README refers to installing @teamclaw/feishu-agent via bun/npm which is normal; there is no opaque download URL or extract/install spec in the skill package itself.

Credentials

The skill does require Feishu app credentials and OAuth tokens at runtime (App ID, App Secret, user access/refresh tokens). Those are proportional to the claimed functionality. Minor inconsistency: registry metadata lists no required env vars, while README/SKILL.md describe storing credentials and mention optional environment variables (e.g., FEISHU_APP_ID/FEISHU_APP_SECRET/FEISHU_BASE_TOKEN). This is not a functional blocker but is a documentation/metadata mismatch.

Persistence & Privilege

The skill will persist credentials/tokens at ~/.feishu-agent/config.json and the agent can be invoked autonomously by default (disable-model-invocation=false). Persisting tokens to the user's home directory is expected for a CLI, but combined with autonomous invocation it means an agent with access to this skill could act on calendars/todos/contacts without repeated interactive consent—so verify who/what is allowed to invoke the skill.

Assessment

Before installing: 1) Confirm the package source — the skill metadata has no homepage/source URL; prefer a package with a known repository or publisher. 2) Inspect the actual package code you will install (npm/bun package contents) to verify there are no hidden network endpoints or unexpected behaviors. 3) Limit Feishu app permissions to the minimum required in the Developer Console and use a dedicated app account you can revoke. 4) Be aware that the CLI stores appId/appSecret and access/refresh tokens in ~/.feishu-agent/config.json (check file permissions, consider encrypting or using a secrets store). 5) If you allow autonomous agent invocation, restrict which agents/contexts can call this skill because stored tokens let the skill perform actions on your calendar/todos/contacts. 6) If metadata/registry source is unclear, consider waiting for a verified homepage or repo before installing; rotate secrets if you test the skill with production credentials.

Feishu Agent Skill

Feishu (Lark) CLI agent - Provides calendar, todo, and contact management capabilities for AI assistants.

Installation

# Install via clawhub
clawhub install feishu-agent

# Or run directly with bunx
bunx @teamclaw/feishu-agent <command>

# Or install globally via bun
bun add -g @teamclaw/feishu-agent
feishu-agent <command>

Quick Start

1. Setup - Configure Feishu app credentials:

   feishu-agent setup
   

2. Authenticate - OAuth 2.0 authorization:

   feishu-agent auth
   

3. Start using - Check your calendar:

   feishu-agent calendar events
   

Capabilities

• 📅 Calendar: List calendars, view events, create/delete events with automatic conflict detection
• ✅ Todo: Manage tasks via Feishu Bitable
• 👥 Contacts: Search and list users from organization
• 🔐 Auth: OAuth 2.0 authentication with automatic token refresh

Commands

Setup & Auth

Command	Description
feishu-agent setup	Interactive setup wizard (App credentials + OAuth + Bitable)
feishu-agent auth	OAuth 2.0 authorization to get user_access_token
feishu-agent whoami	Show current user and authorization status
feishu-agent config list	View global configuration

Calendar Management

Command	Description
feishu-agent calendar	List all calendars (primary, subscribed)
feishu-agent calendar events	List events in primary calendar
feishu-agent calendar create --summary "Meeting" --start "2026-03-05 14:00" --end "2026-03-05 15:00"	Create a new event (auto-checks conflicts)
feishu-agent calendar create --summary "Meeting" --start "..." --end "..." --attendee user_id	Create event with attendees
feishu-agent calendar delete --event-id=evt123	Delete an event

Other Features

Command	Description
feishu-agent todo list	List todos from Bitable
feishu-agent todo create --title "Task" --priority "High"	Create a todo
feishu-agent todo done --record-id=rec123	Mark todo as done
feishu-agent contact list	List users in department
feishu-agent contact search "John"	Search users by name/email

Setup Flow

Option 1: Interactive Setup (Recommended)

feishu-agent setup

This wizard will:

1. Prompt for App ID and App Secret
2. Open browser for OAuth 2.0 authorization
3. Save tokens to ~/.feishu-agent/config.json
4. Optionally fetch Bitable schema

Option 2: Manual Configuration

# Step 1: Set app credentials
feishu-agent config set appId cli_xxxxx
feishu-agent config set appSecret xxxxx

# Step 2: Authorize with user account
feishu-agent auth

Configuration

Global config is stored in ~/.feishu-agent/config.json:

{
  "appId": "cli_xxxxx",
  "appSecret": "xxxxx",
  "userAccessToken": "xxxxx",
  "refreshToken": "xxxxx"
}

Required Feishu App Permissions

In Feishu Developer Console, enable:

• calendar:calendar - View and manage user calendars
• calendar:event - Manage events in calendars
• contact:user.base:readonly - Read user contact info
• bitable:app - Access Bitable data (for todo feature)

Redirect URI must be configured: http://localhost:3000/callback

Use Cases for AI Agents

Schedule a Meeting

feishu-agent calendar create \
  --summary "Team Standup" \
  --start "2026-03-05 10:00" \
  --end "2026-03-05 10:30" \
  --attendee user_id_1 \
  --attendee user_id_2

Note: The command automatically checks for time conflicts using the FreeBusy API. If a conflict is detected, the event creation will fail with a description of the busy time slot.

Check Daily Schedule

feishu-agent calendar events

Manage Tasks

feishu-agent todo create --title "Review PR #123" --priority "High"
feishu-agent todo list
feishu-agent todo done --record-id rec_xxx

Troubleshooting

"User authorization required"

• Run feishu-agent auth to authorize

"Token expired"

• Run feishu-agent auth again to refresh

"Time conflict detected"

• The requested time slot is already busy
• Choose a different time or check your calendar with feishu-agent calendar events

"Permission denied"

• Check app permissions in Feishu Developer Console

License

MIT