Feishu Calendar Advanced

Feishu calendar management via feishu-agent. View calendars, list events, create and delete events with conflict detection.

Security Scan

The skill's instructions match a Feishu calendar helper, but its metadata omits required dependencies and credentials and it tells the agent to install/run a third-party package — these mismatches are concerning.

Purpose & Capability

The SKILL.md clearly requires bun/bunx and the @teamclaw/feishu-agent package and instructs the user to provide Feishu appId/appSecret and perform OAuth. The registry metadata, however, declares no required binaries, no primary credential, and no required env vars. That omission is incoherent: a calendar integration legitimately needs Feishu credentials and a runtime (bun).

Instruction Scope

The runtime instructions stay within calendar-management functionality (list/create/delete events) but direct the agent/user to install and execute a third-party npm package via bunx and to run interactive auth flows. The doc does not say where tokens are stored or how credentials are protected. The instructions also reference appId/appSecret values that are not declared in the skill metadata.

Install Mechanism

There is no formal install spec in the registry (instruction-only), but the SKILL.md instructs using bunx to acquire and run @teamclaw/feishu-agent from the package registry. That is a moderate supply-chain risk: bunx/npm will fetch remote code (unknown maintainer) and execute it locally. This is expected for a CLI-based integration but should be explicitly declared.

Credentials

The skill requires Feishu credentials (appId/appSecret) and OAuth tokens to operate, yet the metadata lists no environment variables or primary credential. Requiring app secrets and OAuth scopes (calendar:calendar, calendar:event) is proportionate to the feature set, but the omission from metadata is a red flag — it prevents an informed permission review before install.

Persistence & Privilege

always is false and there is no install script or evidence the skill will persistently modify agent/system configuration. It's instruction-only and relies on manual bunx install/auth, so it does not request elevated persistent privileges from the registry metadata.

What to consider before installing

This skill appears to do what it claims (Feishu calendar management), but the skill metadata does not declare the real requirements that the SKILL.md asks for. Before installing or running these commands: 1) Verify you trust the @teamclaw/feishu-agent package and its maintainer — consider inspecting its source on the package registry or GitHub first. 2) Be aware bun/bunx will download and execute remote code; install/run in an isolated environment if possible. 3) The SKILL.md requires Feishu appId/appSecret and OAuth; confirm how and where credentials/tokens are stored and avoid pasting secrets into untrusted prompts. 4) Prefer skills whose metadata explicitly lists required binaries and credentials. If you need higher assurance, request the package source or a signed release URL and review it before running bunx.

Manage your Feishu (Lark) calendar using the feishu-agent CLI tool.

Dependencies

Dependency	Required	Description
bun	Yes	Bun runtime (for running bunx commands)
@teamclaw/feishu-agent	Yes	Installed automatically via bunx

Check Dependencies

# Check bun availability
bun --version

Setup

First Time Setup

1. Install and configure feishu-agent:

# Interactive setup wizard (recommended)
bunx @teamclaw/feishu-agent setup

# Or manual configuration
bunx @teamclaw/feishu-agent config set appId <your_app_id>
bunx @teamclaw/feishu-agent config set appSecret <your_app_secret>

2. OAuth Authorization:

bunx @teamclaw/feishu-agent auth

3. Verify setup:

bunx @teamclaw/feishu-agent whoami

Usage

/feishu-calendar-advanced [command] [options]

Commands

Command	Description
calendars	List all calendars (primary, subscribed)
events	List events in primary calendar
create --summary "Meeting" --start "2026-03-05 14:00" --end "2026-03-05 15:00"	Create a new event
create --summary "Meeting" --start "..." --end "..." --attendee user_id	Create event with attendees
delete --event-id <event_id>	Delete an event by ID

Options

Option	Description
--summary	Event title/summary (required for create)
--start	Start time in format "YYYY-MM-DD HH:MM" (required for create)
--end	End time in format "YYYY-MM-DD HH:MM" (required for create)
--attendee	Add attendee by user_id (can be used multiple times)
--event-id	Event ID (required for delete)

Examples

# List all calendars
/feishu-calendar-advanced calendars

# List events in primary calendar
/feishu-calendar-advanced events

# Create a simple event
/feishu-calendar-advanced create --summary "Team Standup" --start "2026-03-05 10:00" --end "2026-03-05 10:30"

# Create event with attendees
/feishu-calendar-advanced create --summary "Project Review" --start "2026-03-05 14:00" --end "2026-03-05 15:00" --attendee user_id_1 --attendee user_id_2

# Delete an event
/feishu-calendar-advanced delete --event-id evt_xxxxxxxxxxxxx

Troubleshooting

"User authorization required"

• Run bunx @teamclaw/feishu-agent auth to authorize

"Token expired"

• Run bunx @teamclaw/feishu-agent auth again to refresh

"Time conflict detected"

• The requested time slot is already busy
• Choose a different time or check your calendar with bunx @teamclaw/feishu-agent calendar events

"Permission denied"

• Check app permissions in Feishu Developer Console
• Required: calendar:calendar, calendar:event