Lark Suite Wiki

Manage and export Lark Suite (Feishu) Wiki/Knowledge Base documents. Read, search, sync with subdocuments, and incremental export to local Markdown files.

Security Scan

The skill mostly does what it says (exports Lark/Feishu wiki to Markdown) but the shipped Python contains hardcoded Lark app credentials which is disproportionate and risky — review before use.

Purpose & Capability

The skill's name, description, commands, and required env vars (LARK_APP_ID, LARK_APP_SECRET) align with a Lark Wiki export tool. However, the included Python file embeds fallback hardcoded credentials (app_id and app_secret) inside the code, which is not necessary for the stated purpose and contradicts the declared requirement to provide env vars.

Instruction Scope

SKILL.md instructs the agent/user to create a Lark app, set env vars, and authorize access — all appropriate. The runtime instructions and included code only call Lark/Open API endpoints and write exported Markdown and a local .lark-sync-state.json file. The problem: the code will silently use embedded default credentials if env vars are not set, which the instructions do not mention. There are no instructions to read unrelated system files or to contact third-party endpoints outside open.larksuite.com.

Install Mechanism

This is instruction-only with a Python script; there is no install spec, no downloads, and no archive extraction. Risk from installation is low because nothing is written by an automated installer beyond the user running the script.

Credentials

Only two environment variables are requested (LARK_APP_ID, LARK_APP_SECRET), which is proportionate for a Lark API client. However, the code includes hardcoded app_id and app_secret fallback values. Embedding credentials in the repository is unnecessary and may leak the maintainer's secret or cause the tool to operate under an unexpected identity if env vars are missing.

Persistence & Privilege

The skill does not request persistent platform-level privileges (always: false). It saves a local .lark-sync-state.json file for incremental sync, which is consistent with the stated behavior and scoped to the output directory. The skill does not modify other skills or system-wide agent configurations.

Scan Findings in Context

[hardcoded-credentials] unexpected: The file larksuite-wiki.py includes literal fallback values for app_id ('cli_a90f6c8bf8f8ded4') and app_secret ('xtSodRRMmiU1R4oikynlFbBoEu3T2Wgo'). Hardcoded credentials are not expected for a client that should use user-provided env vars.

What to consider before installing

This tool appears to do what it claims (export Lark/Feishu wiki content), but the shipped script contains embedded Lark app credentials as fallbacks. Before installing or running it: (1) Inspect the code and remove or replace embedded credentials; (2) do not rely on the defaults — set LARK_APP_ID and LARK_APP_SECRET in your environment with an app you control; (3) ensure the app has only the minimal read permissions and is authorized only to the docs you intend to export; (4) run the script in an isolated environment (non-production machine or container) the first time; (5) if you inadvertently used the embedded credentials with your data, consider whether you granted that app access and rotate any affected secrets or app authorizations. The presence of hardcoded secrets is a hygiene/security issue — treat it as suspicious rather than an outright sign of malicious intent.

Manage and export Lark Suite (Feishu) Wiki/Knowledge Base documents with recursive sync and incremental updates.

Prerequisites

1. Create a Lark/Feishu app at https://open.larksuite.com/console
2. Enable permissions:
   • docs:doc:read
   • drive:drive:read
   • wiki:wiki:read
3. Publish the app and authorize it to access your wiki
4. Set environment variables (or edit script defaults):

   export LARK_APP_ID="cli_xxxxxxxx"
   export LARK_APP_SECRET="xxxxxxxx"
   

Commands

List Wiki Spaces

larksuite-wiki spaces

Read Document (with subdocument links)

larksuite-wiki read <doc_id_or_url>

Export Single Document

larksuite-wiki export <doc_id_or_url> --output ./docs/

Show Document Tree Structure

larksuite-wiki tree <doc_id_or_url>

Sync Entire Wiki (Recursive Export)

# First sync - exports all documents
larksuite-wiki sync <doc_id_or_url> --output ./lark-wiki/

# Incremental sync - only exports changed documents
larksuite-wiki sync <doc_id_or_url> --output ./lark-wiki/

# Force re-export everything
larksuite-wiki sync <doc_id_or_url> --output ./lark-wiki/ --force

Features

1. ✅ Batch Export

Export entire knowledge base with one command.

2. ✅ Recursive Subdocument Export

Automatically follows and exports all linked subdocuments.

3. ✅ Preserves Directory Structure

Creates nested folders matching your wiki structure:

lark-wiki/
├── 01_首页/
│   ├── 01_首页.md
│   └── 01_日常复盘/
│       ├── 01_日常复盘.md
│       └── ...
├── 02_云聪金融分析/
│   └── ...

4. ✅ Incremental Sync

Tracks document revisions and only exports changed documents:

• Saves sync state to .lark-sync-state.json
• Compares revision IDs
• Skips unchanged documents

Quick Start

Export your entire wiki

# Get your wiki root document ID from the URL
# https://xxx.larksuite.com/wiki/TDCZweBJ2iMFO4kI1LAlSE62gnd

# Sync everything
python3 larksuite-wiki.py sync TDCZweBJ2iMFO4kI1LAlSE62gnd --output ./my-wiki/

Daily incremental sync

# Run daily - only exports changed documents
python3 larksuite-wiki.py sync TDCZweBJ2iMFO4kI1LAlSE62gnd --output ./my-wiki/

Output Structure

Each document gets its own folder:

• Main .md file
• Subfolders for child documents
• Numbered prefixes for ordering (01_, 02_, etc.)

API Reference

• Lark Open Platform: https://open.larksuite.com/
• Wiki API: https://open.larksuite.com/document/uAjLw4CM/ukTMukTMukTM/reference/wiki-v1/space/overview
• Docx API: https://open.larksuite.com/document/uAjLw4CM/ukTMukTMukTM/reference/docx-v1/document/overview

Notes

• Documents must be explicitly shared with your app
• Some block types may not convert perfectly to Markdown
• Large wikis with many subdocuments may take time to sync
• Sync state is saved locally for incremental updates