Lark Calendar & Tasks

Create, update, and delete calendar events and tasks in Lark (Feishu). Includes employee directory for automatic name-to-user_id resolution.

Security Scan

The code matches the stated Lark calendar/task purpose, but the package/registry metadata omits required runtime secrets and binaries and there are a few deployment surprises (unknown source, .secrets.env path), so proceed with caution.

Purpose & Capability

The code and SKILL.md implement calendar and task CRUD and an employee directory (including dynamic contact lookup) which is coherent with the skill name/description. However the registry metadata lists no required environment variables or binaries despite the SKILL.md and code clearly requiring FEISHU_APP_ID and FEISHU_APP_SECRET and Node.js to run. This metadata omission is an inconsistency that could mislead users about what secrets/tools are needed.

Instruction Scope

Runtime instructions and scripts only call the Lark (Feishu) APIs and resolve employee names; nothing in SKILL.md or the scripts instructs reading unrelated system files. Business rules (e.g., 'Boyang is always added' to attendees) are documented. One implementation detail to note: the API wrapper loads secrets from a .secrets.env file via dotenv at a relative path (join(__dirname, '../../../../.secrets.env')). That assumes a particular installation layout and will read a dotfile outside the lib directory — verify that the file you provide is the intended credential file and not a broader system file.

Install Mechanism

This is flagged as instruction-only (no install spec) but the package includes package.json/package-lock.json and code that depends on Node and the npm package 'dotenv'. The registry metadata did not declare Node.js as a required binary and provided no install instructions. That mismatch means users may run the scripts without installing dependencies or may not realize they must run npm install or have Node available. No external download URLs are used (only an npm dependency), which is lower risk, but the absent install guidance is a deployment/operational risk.

Credentials

The skill requires FEISHU_APP_ID and FEISHU_APP_SECRET (declared in SKILL.md and used by lib/lark-api.mjs) — these are appropriate and necessary for Lark API access. However the registry metadata claimed no required env vars; that inconsistency is significant because the skill will not work without those secrets and will attempt to read them from a .secrets.env file. Verify you only supply an app credential with minimal scopes needed (calendar, contact readonly, task as applicable).

Persistence & Privilege

The skill does not request permanent/always-included privileges (always: false). It maintains only in-memory caches and does not modify other skills or system-wide agent settings. Autonomous invocation is allowed (platform default) and not by itself a red flag here.

What to consider before installing

What to check before installing or running this skill: - Secrets and binaries: SKILL.md and the code require FEISHU_APP_ID and FEISHU_APP_SECRET and Node.js, but the registry metadata does not list them. Do not assume no secrets are needed — you must provide an app id/secret in .secrets.env and have Node installed. Ensure the FEISHU app credentials you provide have the minimum scopes needed (calendar, task, contact read) and are for the correct tenant. - .secrets.env path: The code loads dotenv from a relative path (../../../../.secrets.env). Confirm where that resolves in your environment and that it points only to the credential file you intend to expose — avoid pointing it to a broader secrets file or repository root that contains unrelated secrets. - Unknown origin: The skill has no homepage and source is unknown. That increases the risk surface. If you plan to use it in production or with real credentials, review the source locally, run it in an isolated environment, and consider creating new FEISHU app credentials you can revoke. - Automatic attendee rule: The skill will always add the user_id 'dgg163e1' (Boyang) to every calendar event. This is documented but can be surprising. If you do not want that behavior, modify the code before use. - Dependency/install: Run npm install to satisfy 'dotenv' dependency before running scripts, and verify Node version compatibility. Consider running the scripts in a disposable container or restricted environment first. - Recommended actions: review the code locally, confirm the FEISHU app permissions, adjust the .secrets.env path if necessary, and test with non-production credentials. If you need stronger assurance, prefer an official integration or a skill with verifiable source/homepage.

Lark Calendar & Task Skill

Create, update, and delete calendar events and tasks in Lark (Feishu).

Overview

This skill provides full CRUD operations for:

• Calendar Events — meetings, appointments, schedules
• Tasks (Todo) — action items with deadlines

Configuration

Required Environment Variables (in .secrets.env):

FEISHU_APP_ID=cli_a9f52a4ed7b8ded4
FEISHU_APP_SECRET=<your-app-secret>

Default Calendar: [e-mail] (Claw calendar)

Default Timezone: Asia/Singapore

Quick Reference

Create Calendar Event

node skills/lark-calendar/scripts/create-event.mjs \
  --title "Meeting with Team" \
  --description "Discuss Q2 roadmap" \
  --start "2026-02-03 14:00:00" \
  --end "2026-02-03 15:00:00" \
  --attendees "Boyang,RK" \
  --location "Meeting Room A"

Parameters:

Param	Required	Description
--title	✅	Event title
--description	❌	Event description
--start	✅	Start time (YYYY-MM-DD HH:MM:SS)
--end	✅	End time (YYYY-MM-DD HH:MM:SS)
--attendees	❌	Comma-separated names (auto-resolved to user_ids)
--attendee-ids	❌	Comma-separated user_ids directly
--location	❌	Event location
--timezone	❌	Timezone (default: Asia/Singapore)
--calendar	❌	Calendar ID (uses default if omitted)

Update Calendar Event

node skills/lark-calendar/scripts/update-event.mjs \
  --event-id "f9900f6b-b472-4b17-a818-7b5584abdc37_0" \
  --title "Updated Title" \
  --start "2026-02-03 15:00:00" \
  --end "2026-02-03 16:00:00"

Delete Calendar Event

node skills/lark-calendar/scripts/delete-event.mjs \
  --event-id "f9900f6b-b472-4b17-a818-7b5584abdc37_0"

List Calendar Events

# List events for next 7 days
node skills/lark-calendar/scripts/list-events.mjs

# List events in date range
node skills/lark-calendar/scripts/list-events.mjs \
  --start "2026-02-01" \
  --end "2026-02-28"

Create Task

node skills/lark-calendar/scripts/create-task.mjs \
  --title "Review PR #123" \
  --description "Code review for authentication module" \
  --due "2026-02-05 18:00:00" \
  --assignees "Boyang,jc"

Parameters:

Param	Required	Description
--title	✅	Task title
--description	❌	Task description
--due	✅	Due date (YYYY-MM-DD HH:MM:SS)
--assignees	❌	Comma-separated names (auto-resolved)
--assignee-ids	❌	Comma-separated user_ids directly
--timezone	❌	Timezone (default: Asia/Singapore)

Update Task

node skills/lark-calendar/scripts/update-task.mjs \
  --task-id "35fc5310-a1b1-49c7-be75-be631d3079ee" \
  --title "Updated Task" \
  --due "2026-02-06 18:00:00"

Delete Task

node skills/lark-calendar/scripts/delete-task.mjs \
  --task-id "35fc5310-a1b1-49c7-be75-be631d3079ee"

Manage Event Attendees

# Add attendees
node skills/lark-calendar/scripts/manage-attendees.mjs \
  --event-id "xxx" --add "RK,jc"

# Remove attendees  
node skills/lark-calendar/scripts/manage-attendees.mjs \
  --event-id "xxx" --remove "jc"

Manage Task Members

# Add members
node skills/lark-calendar/scripts/manage-task-members.mjs \
  --task-id "xxx" --add "RK,jc"

# Remove members
node skills/lark-calendar/scripts/manage-task-members.mjs \
  --task-id "xxx" --remove "jc"

Employee Directory

Names are auto-resolved to Lark user_ids. Supported names:

user_id	Names	Role
dgg163e1	Boyang, by, 博洋	Boss
gb71g28b	RK	Leadership, R&D
53gc5724	Ding	Leadership, Operations
217ec2c2	Charline	HR
f2bfd283	曾晓玲, xiaoling	HR
f26fe45d	HH	Research
45858f91	zan, Eva	-
7f79b6de	Issac	Operations
1fb2547g	王铁柱	Operations
e5997acd	尼克, Nico	Operations
438c3c1f	Ivan	Operations
17g8bab2	Dodo	R&D, Product
73b45ec5	启超, QiChaoShi	R&D, Design
d1978a39	chenglin	R&D, Frontend
ef6fc4a7	冠林, Green	R&D, Frontend
b47fa8f2	sixian, sx, Sixian-Yu	R&D, Frontend
934fbf15	jc, sagiri, 俊晨	R&D, Backend
8c4aad87	大明, daming	R&D, Backend
ab87g5e1	Emily Yobal	Intern
55fa337f	jingda, 景达	Intern
333c7cf1	刘纪源, 纪源, Aiden	Intern

Business Rules

1. Boyang is always added as attendee to every calendar event (automatic)
2. Timezone handling: Uses IANA identifiers (e.g., Asia/Singapore, Asia/Shanghai)
3. Time format: Always YYYY-MM-DD HH:MM:SS
4. user_id vs open_id: This skill uses user_id format (e.g., dgg163e1), NOT open_id (e.g., ou_xxx)

Programmatic Usage

import { createEvent, updateEvent, deleteEvent } from './skills/lark-calendar/lib/calendar.mjs';
import { createTask, updateTask, deleteTask } from './skills/lark-calendar/lib/task.mjs';
import { resolveNames } from './skills/lark-calendar/lib/employees.mjs';

// Create event
const result = await createEvent({
  title: 'Team Sync',
  description: 'Weekly standup',
  startTime: '2026-02-03 10:00:00',
  endTime: '2026-02-03 10:30:00',
  attendeeIds: ['dgg163e1', 'gb71g28b'],
  location: 'Zoom',
  timezone: 'Asia/Singapore'
});

// Create task
const task = await createTask({
  title: 'Review document',
  description: 'Q2 planning doc',
  dueTime: '2026-02-05 18:00:00',
  assigneeIds: ['dgg163e1'],
  timezone: 'Asia/Singapore'
});

Lark API Reference

• Calendar Events API
• Calendar Attendees API
• Tasks API

Permissions Required

Ensure your Lark app has these scopes:

• calendar:calendar — Read/write calendar ✅ (already enabled)
• calendar:calendar:readonly — Read calendar ✅ (already enabled)
• task:task:write — Write tasks ⚠️ (needs to be added for task creation)
• task:task:read — Read tasks
• contact:user.employee_id:readonly — Read user info ✅ (already enabled)

To add permissions:

1. Go to Lark Open Platform
2. Add scopes: task:task:write, contact:contact:readonly (for dynamic employee lookup)
3. Re-publish the app version

Note: Without contact:contact:readonly, the skill uses a static fallback employee list. Update lib/employees.mjs when team changes.