my-lark

Do not install or run this skill in a production or sensitive account until the credential issue is resolved. Key points to consider before proceeding: - The shipped Python code contains a hardcoded App ID and App Secret: that means some API calls will be made under those embedded credentials (likely belonging to the skill author), not under your app. This can give the author/control-plane visibility or control over actions and is a privacy/security risk. - Ask the maintainer to remove hardcoded credentials and to use only the token file you provide, or replace the values in the code with your own app_id/app_secret before use. Prefer a version that reads credentials only from the documented token file. - Resolve the path inconsistencies (the docs alternate between /workspace/.lark_tokens.json and ~/.lark_tokens.json and reference differing script locations) so you know exactly which file is used. - Review or audit the lark-mcp npm package before installing it globally, and consider running the skill in an isolated environment (separate account or sandbox) first. - If you already used this skill with sensitive tokens, rotate those credentials (app_secret / tokens) to be safe.