Feishu Calendar Conflict Detector

Feishu Calendar Conflict Detector - Detect scheduling conflicts before booking meetings. **Features**: - Check if attendees are available before creating mee...

Security Scan

The skill's instructions match a Feishu calendar conflict-checker, but it omits or fails to declare the Feishu credentials/scopes and makes runtime assumptions about available agent tools/context, which is an incoherence the user should understand before installing.

Purpose & Capability

The SKILL.md describes exactly the expected calendar capabilities (free/busy queries, event creation, user lookup). However, it assumes access to Feishu calendar APIs (tools named feishu_calendar_freebusy, feishu_calendar_event, feishu_search_user) without declaring any required credentials or environment variables. Real Feishu integrations normally need app credentials or tokens (app_id/app_secret/tenant_access_token or OAuth scopes). That mismatch (capability requires credentials but none are requested) is a material incoherence.

Instruction Scope

Instructions are narrowly scoped to searching users, querying free/busy, suggesting slots, and optionally creating events. They reference getting user_open_id from message context (SenderId) and give concrete JSON examples. They do not instruct reading arbitrary files or other environment variables. Caveat: they implicitly rely on message context and platform-provided tools; if those are not available, the skill will need credentials or additional steps not described.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so it doesn't write binaries or download code. That minimizes installation risk.

Credentials

The skill requests no environment variables or credentials even though access to Feishu calendars normally requires credentials and specific API scopes. The absence of declared required env vars (e.g., FEISHU_APP_ID, FEISHU_APP_SECRET, TENANT_ACCESS_TOKEN, or an OAuth flow) is disproportionate to the stated functionality and should be clarified.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request persistent or platform-wide privileges. Nothing in the SKILL.md indicates it tries to modify other skills or agent configuration.

What to consider before installing

This skill appears to actually need Feishu API access, but it does not declare any required credentials or scopes. Before installing or enabling it, ask the author or vendor: (1) how will the skill authenticate to Feishu? (list exact env vars or describe the OAuth flow), (2) what API scopes are required (calendar read/write, user search), and where credentials will be stored, (3) whether the platform will supply SenderId/user_open_id in message context or whether the skill will call a user-search API (which itself needs credentials). If these questions are not answered, treat the skill as incomplete or potentially misconfigured; do not grant any Feishu admin tokens or broad credentials until you verify minimal scopes and secure storage. If you rely on a managed platform integration that already provides Feishu tokens, confirm that the integration's scopes are limited to what's required (free/busy read and optionally event:create) and that billing/pricing claims match your expectations.

⚠️ Pre-requisites

• ✅ Time format: ISO 8601 / RFC 3339 (with timezone), e.g. 2026-03-31T14:00:00+08:00
• ✅ Batch query: Can check up to 10 users at once
• ✅ user_open_id needed: Get from message context SenderId

---

📋 Quick Reference

Intent	Tool	action	Required Params
Check free/busy	feishu_calendar_freebusy	list	time_min, time_max, user_ids
Create meeting	feishu_calendar_event	create	summary, start_time, end_time
Query user ID	feishu_search_user	-	query

---

🛠️ Usage

1. Check Single User Availability

{
  "action": "list",
  "time_min": "2026-03-31T09:00:00+08:00",
  "time_max": "2026-03-31T18:00:00+08:00",
  "user_ids": ["ou_xxx"]
}

Response format:

{
  "busy_slots": [
    {"start": "2026-03-31T10:00:00+08:00", "end": "2026-03-31T11:00:00+08:00"},
    {"start": "2026-03-31T14:00:00+08:00", "end": "2026-03-31T15:30:00+08:00"}
  ],
  "free_slots": [
    {"start": "2026-03-31T09:00:00+08:00", "end": "2026-03-31T10:00:00+08:00"},
    {"start": "2026-03-31T11:00:00+08:00", "end": "2026-03-31T14:00:00+08:00"},
    {"start": "2026-03-31T15:30:00+08:00", "end": "2026-03-31T18:00:00+08:00"}
  ]
}

2. Check Multiple Users Availability

{
  "action": "list",
  "time_min": "2026-03-31T09:00:00+08:00",
  "time_max": "2026-03-31T18:00:00+08:00",
  "user_ids": ["ou_xxx", "ou_yyy", "ou_zzz"]
}

Result: Returns common free time slots when ALL users are free.

3. Find Available Meeting Slots

Algorithm:

1. Get busy slots for all attendees
2. Find gaps between busy slots
3. Filter by minimum meeting duration
4. Return available windows

Example: 2-hour meeting, 3 attendees

{
  "action": "list",
  "time_min": "2026-03-31T09:00:00+08:00",
  "time_max": "2026-03-31T18:00:00+08:00",
  "user_ids": ["ou_xxx", "ou_yyy", "ou_zzz"]
}

Suggested slots (if busy 10-11, 14-15:30):

• 09:00-10:00 ✓
• 11:00-14:00 ✓
• 15:30-18:00 ✓

4. Conflict Warning

Before creating a meeting, warn user if conflicts exist:

{
  "action": "list",
  "time_min": "2026-03-31T10:00:00+08:00",
  "time_max": "2026-03-31T11:00:00+08:00",
  "user_ids": ["ou_xxx", "ou_yyy"]
}

If response shows busy slots in this time range → Conflict detected!

---

💰 Pricing

Version	Price	Features
Free	¥0	Check 1-2 users
Pro	¥12/month	Check up to 10 users, auto-suggest slots
Team	¥35/month	Historical analysis, recurring meeting conflicts

---

📝 Example

User says: "看一下明天上午10点张三和李四有没有空"

Execute:

1. Search for 张三 and 李四 to get open_ids
2. Query free/busy for tomorrow morning 09:00-12:00
3. Check if 10:00-11:00 is in free slot
4. Report availability

Response: "张三和李四在明天上午10点都OK，没有冲突 ✓"

---

🔧 Tips

• Query 30 minutes before/after desired time for buffer
• Consider user's working hours (default: 09:00-18:00)
• For international teams, account for timezone differences
• Use "tentative" status as "may be busy" warning