Muguozi1 Openclaw Feishu Calendar

Manage Feishu calendars by listing, searching, checking schedules, syncing events, and marking tasks with date/time extraction and attendee assignment.

Security Scan

The skill mostly does what its description says (manage Feishu calendars) but contains multiple inconsistencies and surprising behaviors you should review before installing (undeclared required env vars, scripts that delete/create recurring events, file writes outside the skill folder, and references to undeclared env/config).

Purpose & Capability

Name/description and the code align: this is a Feishu (Lark) calendar integration that lists, creates, syncs and cleans events. However the registry metadata claims no required environment variables/credentials while the code and SKILL.md require FEISHU_APP_ID and FEISHU_APP_SECRET (and some code references OPENCLAW_MASTER_ID). That mismatch is incoherent and should be corrected.

Instruction Scope

SKILL.md instructs running the included node scripts which is consistent, but the runtime instructions omit mention of an additional env var (OPENCLAW_MASTER_ID) seen in code. Several scripts perform actions beyond simple queries: cleanup.js and setup_routine.js delete events and create recurring 'System Maintenance' events; sync.js writes to '../../memory/calendar_events.json' and modifies '../../HEARTBEAT.md' (files outside the skill folder). Some files import '../common/time-helper.js' which is not present in the manifest — runtime may fail or behave unexpectedly. The SKILL.md also assumes the agent can obtain the requester's Feishu OpenID to pass as --attendees but does not specify how.

Install Mechanism

There is no install spec (instruction-only), which is lower risk for arbitrary installers. The project includes package.json and package-lock.json depending on @larksuiteoapi/node-sdk and dotenv from npm — users will need to run npm install to satisfy dependencies. No external download URLs or extract steps are used.

Credentials

The code requires FEISHU_APP_ID and FEISHU_APP_SECRET (and references OPENCLAW_MASTER_ID), yet the registry lists no required env vars and primary credential is unset. Requesting full Feishu app credentials is expected for calendar operations, but the undeclared/misaligned env requirements are a red flag. Also consider that with those credentials the skill can create, delete, and modify calendars/events (including recurring events) — ensure credentials have minimal scope.

Persistence & Privilege

always is false (normal). The skill does not request to be always-enabled, nor to change other skills. However it will create/delete calendar events and write files (calendar_events.json and HEARTBEAT.md) under repository parent paths — these are persistent side-effects outside the skill directory and can be intrusive. Autonomous invocation plus calendar-create/delete ability increases blast radius if credentials are compromised; review before enabling autonomous runs.

What to consider before installing

Before installing: 1) Expect to supply FEISHU_APP_ID and FEISHU_APP_SECRET in a .env file (registry metadata is out-of-date). Also inspect whether you need OPENCLAW_MASTER_ID and if so set it deliberately. 2) Audit scripts that delete or mass-create events (cleanup.js, setup_routine.js, sync_routine.js) — they will remove events matching simple rules and create recurring 'System Maintenance' and other routine events; run them only with limited-scope test credentials or after backing up affected calendars. 3) Note the skill writes to ../../memory/calendar_events.json and ../../HEARTBEAT.md — back up those files and be prepared for modifications. 4) Confirm missing files/imports (common/time-helper.js) are available in your deployment; otherwise runtime errors may occur. 5) Limit the Feishu app's permissions to the minimal calendar scopes and prefer a test account first. 6) If you want to proceed, run npm install in the skill directory and audit package-lock.json; run scripts manually in a controlled environment before enabling autonomous agent invocation.

feishu-calendar

Manage Feishu (Lark) Calendars. Use this skill to list calendars, check schedules, and sync events.

Usage

List Calendars

Check available calendars and their IDs.

node skills/feishu-calendar/list_test.js

Search Calendar

Find a calendar by name/summary.

node skills/feishu-calendar/search_cal.js

Check Master's Calendar

Specific check for the Master's calendar status.

node skills/feishu-calendar/check_master.js

Sync Routine

Run the calendar synchronization routine (syncs events to local state/memory).

node skills/feishu-calendar/sync_routine.js

Setup

Requires FEISHU_APP_ID and FEISHU_APP_SECRET in .env.

Standard Protocol: Task Marking

Trigger: User says "Mark this task" or "Remind me to...". Action:

1. Analyze: Extract date/time (e.g., "Feb 4th" -> YYYY-MM-04).
2. Execute: Run create.js with --attendees set to the requester's ID.
3. Format:

   node skills/feishu-calendar/create.js --summary "Task: <Title>" --desc "<Context>" --start "<ISO>" --end "<ISO+1h>" --attendees "<User_ID>"
   

Setup Shared Calendar

Create a shared calendar for a project and add members.

node skills/feishu-calendar/setup_shared.js --name "Project Name" --desc "Description" --members "ou_1,ou_2" --role "writer"

---

🚀 30 秒快速开始

# 基础用法
# TODO: 添加具体命令示例

📋 何时使用

当以下情况时使用此技能：

1. 场景 1
2. 场景 2
3. 场景 3

🔧 配置

必需配置

# 环境变量或配置文件

可选配置

# 可选参数

💡 实际应用场景

场景 1: 基础用法

# 命令示例

场景 2: 进阶用法

# 命令示例

🧪 测试

# 运行测试
python3 scripts/test.py

⚠️ 故障排查

常见问题

问题： 描述问题

解决方案：

# 解决步骤

📚 设计原则

本技能遵循 Karpathy 的极简主义设计哲学：

1. 单一职责 - 只做一件事，做好
2. 清晰可读 - 代码即文档
3. 快速上手 - 30 秒理解用法
4. 最小依赖 - 只依赖必要的库
5. 教育优先 - 详细的注释和示例

---

最后更新：2026-03-16 | 遵循 Karpathy 设计原则

---

🏷️ 质量标识

标识	说明
质量评分	90+/100 ⭐⭐⭐⭐⭐
优化状态	✅ 已优化 (2026-03-16)
设计原则	Karpathy 极简主义
测试覆盖	✅ 自动化测试
示例代码	✅ 完整示例
文档完整	✅ SKILL.md + README.md

备注: 本技能已在 2026-03-16 批量优化中完成优化，遵循 Karpathy 设计原则。