Guide · Agent skill

How to use the Lark CLI Shared Rules agent skill (lark-shared)

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

The lark-shared skill is the shared foundation for the Lark (Feishu) command-line tool skills. It gives an AI agent the rules for logging in with lark-cli, choosing whether to act as a user or as the app bot, requesting business-domain permissions, and reading the CLI's JSON success and error output. After this guide you will know how to install the skill, how to phrase requests so it triggers, and what safety behaviour to expect.

Lark CLI Shared Ruleslarksuite/cli · MIT Download the skill

Quick start

1Install lark-cli. Install the lark-cli command-line tool on the machine where the agent runs, since the skill requires it.
2Install the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ or a project's .claude/skills/, or upload it under Settings → Capabilities → Skills in the Claude apps.
3Configure the app. On first use, run lark-cli config init --new to set up the app. Open the authorization link the command outputs, using the QR code the agent generates.
4Log in and check status. Ask the agent to log in and verify the session. It will run auth status with verification.
5Choose identity and permissions. Decide whether the task should act as the user or the bot, then request only the business domain or scope you need.
6Approve high-risk writes. When the CLI returns exit code 10, review the action and risk the agent shows you, and reply explicitly if you agree.

What is an agent skill and what does lark-shared make the agent do?

An agent skill is a folder with a SKILL.md file and optional reference files that an AI agent loads when a request matches the skill's description. This one, lark-shared, covers setup and authentication tasks for lark-cli: auth login, auth status and auth logout, the difference between user and bot identity, business-domain permissions, missing scopes, revoking authorization, and the _notice field in JSON output.

Its main job is to make the agent behave carefully. Before running a command it should read the relevant reference or run --help rather than guess flags. It should also stop and ask you before any high-risk write.

Checks login state with auth status and reports the identity, token status and scopes.
Chooses --as user or --as bot based on whose resources are involved.
Requests business-domain permissions with --domain, such as docs or drive, or a single --scope.
Reads the success envelope (ok == true) and error envelope correctly.
Shows QR codes for authorization links and passes URLs through unchanged.
Uses only relative file paths.

How do you install the lark-shared skill?

Download the ZIP for the skill from this page. Then install it in one of two ways.

For Claude Code, unzip the folder into ~/.claude/skills/ to make it available everywhere, or into .claude/skills/ inside a project to make it available only in that project.

In the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

Personal install: unzip into ~/.claude/skills/
Project install: unzip into .claude/skills/ in your project folder
Claude apps: Settings → Capabilities → Skills, then upload the ZIP

What do you need before the skill is useful?

The skill declares lark-cli as a required binary, so the lark-cli command-line tool must be installed on the machine where the agent runs. The skill does not install it for you.

For auth and config steps you also need a Lark or Feishu app and an account to authorize against. The skill uses network access to talk to Lark. It does not run bundled scripts.

lark-cli installed and available on the command line
A Lark/Feishu app and account for authorization and configuration
Network access (the skill uses the network)

How do you trigger the skill with natural requests?

You do not need to type the skill name. Ask in plain language about the setup or auth task. The description matches requests about login, status, logout, identity, permissions, missing scopes, revoking authorization, or _notice output.

Name the business area when you need specific permissions, since the skill maps those to --domain values such as all, docs or drive.

"Log lark-cli in and check that the login is valid."
"Which identity should this command use, user or bot?"
"Get docs and drive permissions for lark-cli."
"The bot is missing a scope. What do I do?"
"Revoke the authorization for my Lark account on this machine."

lark-cli auth status --json --verify

What commands does the skill rely on?

The skill's reference table lists the preferred command for each auth task. Login for a business area uses --domain, which can be repeated or comma-separated. Login for one permission uses --scope with the scope name in quotes.

Logout clears only the login on the local machine. Cancelling server-side authorization must be done by the user on the Lark authorization management page. The CLI cannot revoke a single scope that was already granted.

All permissions: auth login --domain all --no-wait --json
Specific business domains: auth login --domain docs --domain drive --no-wait --json
One scope: auth login --scope "<scope>" --no-wait --json
Check status: auth status --json --verify
Log out locally: auth logout --json

lark-cli auth login --domain docs --domain drive --no-wait --json

How does the skill handle safety, approvals and file paths?

High-risk writes are gated. When a command needs confirmation, lark-cli exits with code 10 and returns a confirmation_required error. The skill tells the agent to show you the action, risk and key parameters, and to add the confirmation flag only after you explicitly agree. It must never add that flag silently.

The skill also forbids printing secrets such as appSecret or accessToken in plain text. When a command supports --dry-run, the agent should preview dangerous requests with it first. File path arguments accept only relative paths under the current directory, because absolute paths fail with an unsafe file path error.

Exit code 10 is a confirmation gate, not a failure: the agent stops and asks you.
Secrets are not printed in plain text.
Use --dry-run to preview risky requests where the command supports it.
Use relative paths for --file, --output, --output-dir and @file.

What people use it for

Logging a developer into lark-cli and confirming the token is valid before automation runs.
Deciding whether a calendar or cloud drive task should run as the user's own account or as the app bot.
Requesting docs and drive permissions for a team automation without asking for every scope.
Recovering from a missing-scope error by pointing you to the console link for the bot.
Building other lark-* skills that rely on the same identity and output rules.

Frequently asked questions

Is the lark-shared skill free to use?

The source material does not state pricing or licence terms for the skill beyond its MIT licence, which is listed for the larksuite/cli repository. Check the repository's licence file for the full terms. The lark-cli tool and any Lark or Feishu account you use may have their own terms.

Do I need lark-cli installed before installing this skill?

Yes. The skill declares lark-cli as a required binary and does not install it. You must have the command-line tool available before the skill can do anything.

Does the skill run scripts on my computer?

No. The skill's metadata says it runs no scripts, but it does use the network. It works by guiding the agent to run lark-cli commands.

What is the difference between user and bot identity in lark-cli?

With --as user the command acts as you and can reach your own calendar and cloud drive resources. With --as bot it acts as the app and can only reach the bot's own resources, and a bot query for user data returns an empty success rather than an error.

Why did my command exit with code 10?

Exit code 10 means a high-risk write needs your confirmation. It is not an error. The agent should show you the action and risk, and only add the confirmation flag after you approve.

How do I log out of lark-cli or revoke access?

auth logout clears the login on the local machine only. To cancel all server-side authorization, the user must do it on the Lark authorization management page. The CLI cannot revoke one scope on its own.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use lark-shared if you automate Lark or Feishu tasks with lark-cli and need the agent to handle login, identity and permissions carefully, or if you plan to build other lark-* skills on the same rules. Skip it if you do not use Lark, Feishu or lark-cli, or if you need unattended high-risk writes, because the skill requires your explicit approval for those.

Download the skill