跳转到正文
skillsafebeta
← 报告库
用途分类 / 数据分析

Lark Im Skill 安全审计

作者说它能做什么（原文）

飞书即时通讯：收发消息和管理群聊。发送和回复消息、搜索聊天记录、管理群聊成员、上传下载图片和文件、管理表情回复、发送应用内/短信/电话加急、发送和处理交互卡片（Interactive Card）、监听卡片按钮回调（card.action.trigger）。当用户需要发消息、查看或搜索聊天记录、下载聊天中的文件、查看群成员、搜索群、创建群聊或话题群、管理标记数据、管理 Feed 置顶（添加/移除/查询置顶会话）、管理标签数据、处理卡片回调时使用。

第三方安全检查结论

先别安装或运行

已检查文件
61
发现的风险
5
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
高风险

转发 Markdown 可触发远程下载并把取得的内容上传到飞书

原文依据：4 处
发现了什么

Skill 要求转发文档时保留原始文本并用 --markdown 发送；发送器会解析远程 Markdown 图片 URL，先下载再上传。可见规则没有限制目标主机、私网地址或重定向。

为什么需要注意

恶意或被篡改的文档只需嵌入图片 URL，就可能让运行 lark-cli 的环境访问攻击者跟踪地址或内部 HTTP 资源，并把成功取得的图片内容上传到飞书消息中。

在转发飞书文档时，Skill 要求保留原始 Markdown；发送路径会解析其中的远程图片 URL，下载后再上传到飞书。若文档包含不可信图片链接，执行发送会让本机访问该地址并把响应作为图片上传。可见规则未给出主机、私网地址或重定向限制。用户可要求只允许可信 HTTPS 域名，或在转发前移除/预览远程图片。发送本身仍要求用户明确批准。

SKILL.md:79来自说明文档
When sending content fetched from a Lark doc as a message, fetch the doc with --doc-format im-markdown, then send it as a message using the --markdown format. The fetched content is already in markdown; in any content-forwarding scenario, keep the fetched original text and send it in the --markdown format. Note: if the doc contains a cite tag with type="user", keep it as-is and do not strip the tag.
查看另外 3 个位置
references/lark-im-messages-send.md:49来自说明文档
The shortcut does all of the following before sending:1. Forces `msg_type=post`2. Resolves remote Markdown images like `![x](https://...)` by downloading and uploading them first3. Normalizes the Markdown for Feishu post rendering4. Wraps the result as:
references/lark-im-messages-send.md:75来自说明文档
- Already-uploaded `img_xxx` image keys are the most reliable Markdown image input.- Local paths in Markdown image syntax like `![x](./a.png)` are **not** supported and will not be auto-uploaded.- Remote URLs (`https://...`) will be auto-downloaded and uploaded at runtime; if the download or upload fails, the image is removed with a warning.
references/lark-im-messages-send.md:11来自说明文档
Messages sent by this tool are visible to other people. Before calling it, you **must** confirm with the user:1. The recipient (which person or which group)2. The message content3. The sending identity (user or bot)**Do not** send messages without explicit user approval.
中风险

普通消息读取会默认扩大到表情和最多 500 条话题回复

原文依据：3 处
发现了什么

读取命令默认附加表情数据；mget 和聊天消息列表还会自动抓取发现的话题回复，每页累计上限为 500。用户仅要求查看主消息或少量记录时，这会读取更多会话数据并产生额外 API 请求。

为什么需要注意

代理上下文和命令输出可能包含用户未预期的话题内容、参与者反应及额外消息；所需 reactions scope 也扩大了授权面。

读取快捷命令默认额外查询表情；其中 mget 和聊天消息列表还会对每条带 thread_id 的消息自动读取回复，单页累计默认可达 500 条。这可能超出“查看几条主消息”的预期，扩大聊天数据暴露并增加 API 调用。`--no-reactions`只能关闭表情查询，可见文本没有给出关闭话题自动展开的选项。用户可要求限制页数/目标消息，并在作者提供开关前避免用于最小化读取场景。

SKILL.md:59来自说明文档
The four message-pulling shortcuts (`+messages-mget`, `+chat-messages-list`, `+messages-search`, `+threads-messages-list`) automatically attach a `reactions` block and (for edited messages) `update_time` to each returned message — no separate `im.reactions.batch_query` call is needed. Pass `--no-reactions` to opt out. For the full contract (output shape, the `im:message.reactions:read` scope requirement, and the "missing field ≠ fetch failure" data rules), read [`references/lark-im-message-enrichment.md`](references/lark-im-message-enrichment.md).
查看另外 2 个位置
references/lark-im-message-enrichment.md:13来自说明文档
`+messages-mget` and `+chat-messages-list` also auto-expand thread replies: any returned message that carries a `thread_id` triggers a fetch of that thread's replies, which are attached as a `thread_replies` array on the host. Fetches across distinct threads run with bounded concurrency (up to 4 in flight). Two caps gate the result:- **`perThread` (default 50)** — max replies fetched for any single thread.- **`totalLimit` (default 500)** — max cumulative replies across all threads on the page.
references/lark-im-message-enrichment.md:9来自说明文档
- **`update_time`** — emitted only when `updated == true` (message was actually edited). The server echoes `update_time == create_time` for unedited messages too, but the CLI gates that output away so consumers don't misread every message as "edited".- **Opt-out** — each shortcut accepts `--no-reactions` to skip the extra round-trip when the caller only needs message bodies.
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 2 项风险
高风险

卡片自动处理缺少操作者授权检查

原文依据：4 处
发现了什么

用户只需确认一次自动处理，随后每个回调都被立即处理。流程读取操作者和表单值后，可把“业务操作”判为需要更新并调用更新接口，但可见规则没有要求核验 operator_id、chat_id、角色或允许的动作。

为什么需要注意

群内任何能操作卡片的人都可能驱动代理改变共享卡片状态；若作者把按钮关联到审批、工单或其他业务动作，未授权参与者可能影响他人的决策或工作流。

该流程只在开始自动处理前取得一次确认，之后要求立即处理每条回调，并可依据模型判断用事件令牌更新完整卡片；可见规则未要求按 operator_id、chat_id、角色或动作白名单逐次授权。若卡片可被范围外人员操作，其输入可能改变所有收件人看到的卡片。用户可要求作者提供操作者/群聊/动作白名单，并限制监听范围。

references/lark-im-card-action-reply.md:95来自说明文档
Only enter the auto-update workflow below if the user confirms. If your runtime does notsupport background monitoring, inform the user that automatic card updates are not availableand they will need to handle interactions manually.## Agent workflowWhen a `card.action.trigger` event arrives (**each stdout JSON line is one event — process it immediately**):
查看另外 3 个位置
references/lark-im-card-action-reply.md:104来自说明文档
```1. Read action fields to understand what the user did:   - action_tag: which component was triggered   - action_value / option / options / checked / input_value / form_value: what value was set2. Decide: does this interaction require a card update?   - e.g. button click with a business action → yes   - e.g. navigation / pagination → no (just record, no update needed)   - Not every callback requires a card update — decide based on business semantics   - Before updating, explicitly state what visual change the action requires. If you cannot articulate one, skip the update.3. If update is needed:   a. If card_content is empty: inform the user that the original card could not be fetched,      so it is not possible to determine whether an update is needed — do not guess   b. Determine the new card state based on the action   c. Use card_content as the structural basis to construct the updated card JSON   d. Detect card version: if card_content contains `"schema":"2.0"` or `"schema": "2.0"` it is Card 2.0; otherwise assume Card 1.0   e. For Card 1.0: include `"open_ids": ["<operator_id>"]` inside the `card` object, or the API returns code 300090   f. Call the delayed update API with the token and new card JSON
references/lark-im-card-action-reply.md:101来自说明文档
When a `card.action.trigger` event arrives (**each stdout JSON line is one event — process it immediately**):```1. Read action fields to understand what the user did:   - action_tag: which component was triggered   - action_value / option / options / checked / input_value / form_value: what value was set2. Decide: does this interaction require a card update?   - e.g. button click with a business action → yes   - e.g. navigation / pagination → no (just record, no update needed)   - Not every callback requires a card update — decide based on business semantics   - Before updating, explicitly state what visual change the action requires. If you cannot articulate one, skip the update.
references/lark-im-card-action-reply.md:117来自说明文档
      so it is not possible to determine whether an update is needed — do not guess   b. Determine the new card state based on the action   c. Use card_content as the structural basis to construct the updated card JSON   d. Detect card version: if card_content contains `"schema":"2.0"` or `"schema": "2.0"` it is Card 2.0; otherwise assume Card 1.0   e. For Card 1.0: include `"open_ids": ["<operator_id>"]` inside the `card` object, or the API returns code 300090   f. Call the delayed update API with the token and new card JSON
中风险

排错文档可能诱导授予不必要的联系人目录权限

原文依据：2 处
发现了什么

主说明明确称消息发送者姓名不需要联系人 scope，但 mget 的权限错误排查却要求同时启用 contact:user.base:readonly。该建议会把普通消息读取故障引向更广的联系人权限。

为什么需要注意

用户可能为修复消息读取而额外开放员工基础资料访问，使应用获得与实际任务无关的目录数据权限。

主说明明确表示发送者姓名由消息接口直接提供，不需要联系人目录权限；但 mget 的“权限不足”排错行却建议同时启用 `contact:user.base:readonly`。这是排错建议而非自动申请权限，但用户照做会授予与所述姓名解析无关的联系人读取范围。用户可先只授权消息读取权限，并要求作者说明联系人权限对应的独立功能依据。

SKILL.md:52来自说明文档
- **Server-provided name**: the read APIs return `sender_name` (plus the full-i18n `sender_i18n_names` map) on each message `sender`; the CLI surfaces it as the sender's `name` for users and bots alike. No name lookup and no extra permission are needed — **no contact scope** and no `application:bot.basic_info:read`.- **Fallback to id**: when the server does not provide a name, the sender is shown by its id and the command still exits 0. There is no contact-directory fallback.
查看另外 1 个位置
references/lark-im-messages-mget.md:94来自说明文档
| `invalid message ID: must start with om_` | Invalid message ID format | Message IDs must start with `om_` || Permission denied | Message read permission is missing | Ensure the app has `im:message:readonly` and `contact:user.base:readonly` enabled || Empty result | Message IDs do not exist or are not accessible | Verify the IDs and access permissions |
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 1 项风险
中风险

卡片失败重试没有幂等键，可能重复发送

原文依据：3 处
发现了什么

卡片流程使用没有 --idempotency-key 的发送命令，并要求失败后自动重试最多三次，再降级重发。若服务端已接受消息但客户端因超时或响应丢失判断失败，下一次发送会成为新的消息。

为什么需要注意

收件人可能收到重复通知、审批卡或操作入口；多张仍可点击的卡片还可能造成重复审批或重复业务处理。

卡片发送示例未使用幂等键，失败处理又要求最多重发三次，之后还可能降级再发。若请求已被飞书接受但客户端因超时或响应丢失报告失败，后续调用可能产生重复卡片。发送快捷命令本身支持一小时幂等键，因此这是可避免的缺口。用户可要求所有重试复用同一幂等键，并在不确定结果时先核对消息是否已创建。

references/card/lark-im-card-create.md:101来自说明文档
```bash# 发送到群聊lark-cli im +messages-send --chat-id oc_xxx --msg-type interactive --content '<card_json>'# 发送给指定用户（私聊）lark-cli im +messages-send --user-id ou_xxx --msg-type interactive --content '<card_json>'```
查看另外 2 个位置
references/card/lark-im-card-create.md:109来自说明文档
**发送失败时**：先对照下方常见失败列表排查，若能匹配则按对应处理方式修复后重新发送；否则根据错误信息修复 JSON 后重新发送。最多尝试 **3 次**。若 3 次后仍失败，**降级为 Card 1.0 卡片**重新构造并发送。**不参考之前发送 2.0 的记忆**，完全根据用户意图重新构造 1.0 卡片。1.0 无本地参考文档（components/、resource/ 均为 2.0）。**常见失败列表**
references/lark-im-messages-send.md:196来自说明文档
| `--msg-type <type>` | No | Message type (default `text`). If you use `--text` / `--markdown` / media flags, the effective type is inferred automatically. Explicitly setting a conflicting `--msg-type` fails validation || `--idempotency-key <key>` | No | Idempotency key, max 50 characters; the same key sends only one message within 1 hour                                                                                                        || `--as <identity>` | No | Identity type: `bot` or `user` (default `bot`)                                                                                                                                                |

Skill 逻辑拆解

6 个说明模块

该 Skill 通过 lark-cli 以用户令牌或机器人令牌操作飞书聊天，可读取消息和成员，也可发送、编辑、撤回消息及管理群聊、置顶和标签；实际权限取决于所选身份及已授予的 scope。

查看原文
SKILL.md:44来自说明文档
- `--as user` means **user identity** and uses `user_access_token`. Calls run as the authorized end user, so permissions depend on both the app scopes and that user's own access to the target chat/message/resource.- `--as bot` means **bot identity** and uses `tenant_access_token`. Calls run as the app bot, so behavior depends on the bot's membership, app visibility, availability range, and bot-specific scopes.- If an IM API says it supports both `user` and `bot`, the token type changes who the operator is. The same API can succeed with one identity and fail with the other because owner/admin status, chat membership, tenant boundary, or app availability are checked against the current caller.
SKILL.md:153来自说明文档
  - `create` — 将用户或机器人拉入群聊。Identity: supports `user` and `bot`; the caller must be in the target chat; for `bot` calls, added users must be within the app's availability; for internal chats the operator must belong to the same tenant; if only owners/admins can add members, the caller must be an owner/admin, or a chat-creator bot with `im:chat:operate_as_owner`.  - `delete` — 将用户或机器人移出群聊。Identity: supports `user` and `bot`; only group owner, admin, or creator bot can remove others; max 50 users or 5 bots per request.

发送、回复和编辑操作的专项文档要求先确认目标、内容和身份；这些操作会产生其他人可见的外部变更。

查看原文
references/lark-im-messages-send.md:11来自说明文档
Messages sent by this tool are visible to other people. Before calling it, you **must** confirm with the user:1. The recipient (which person or which group)2. The message content3. The sending identity (user or bot)**Do not** send messages without explicit user approval.
references/lark-im-messages-edit.md:11来自说明文档
Editing rewrites a message visible to other people. Before calling it, you **must** confirm with the user:1. Which message to edit (its `message_id`)2. The new contentThe bot must be the original sender — editing another identity's message fails. Identity is always the bot: user identity is rejected server-side (`user access token not support`).**Do not** edit a message without explicit user approval.

读取消息时默认还会查询表情回复，并可自动展开话题回复；附件下载另需显式启用，下载后会写入当前工作目录下的 lark-im-resources。

查看原文
references/lark-im-message-enrichment.md:13来自说明文档
`+messages-mget` and `+chat-messages-list` also auto-expand thread replies: any returned message that carries a `thread_id` triggers a fetch of that thread's replies, which are attached as a `thread_replies` array on the host. Fetches across distinct threads run with bounded concurrency (up to 4 in flight). Two caps gate the result:- **`perThread` (default 50)** — max replies fetched for any single thread.- **`totalLimit` (default 500)** — max cumulative replies across all threads on the page.
references/lark-im-message-enrichment.md:24来自说明文档
`+chat-messages-list`, `+messages-mget`, and `+threads-messages-list` accept an **opt-in** `--download-resources` flag. It is **off by default** — when omitted, output and the request count are identical to before (no `resources` block, no extra round-trips).When enabled:- Each message that carries downloadable resources gets a `resources` array. Eligible types: `image`, `file`, `audio`, `video`, `media`, and post-embedded `img` / `media`. **Stickers are excluded** (Feishu does not support fetching sticker resources).- Each ref is `{message_id, key, type, local_path, size_bytes}` — `type` is `image` or `file`; `message_id` is the id used to fetch the resource. For a standalone message that is its own id; for a resource inside a **merge_forward** it is the **top-level container** `message_id`, not the sub-item's own id (the download endpoint rejects sub-item ids with `234003 File not in msg` and can only fetch a forwarded resource through the container). Thread replies each get their own block.- Files download into `./lark-im-resources/` under the current working directory. Each distinct `(message_id, file_key)` is downloaded once (deduped) with bounded concurrency (up to 3 in flight).- **Fail-silent isolation**: a single resource that fails to download is flagged `"error": true` with one stderr line (`warning: resource_download_failed: <message_id>/<key>: ...`); the main message and the other resources are unaffected.

互动卡片监听器经用户一次确认后，会持续处理每条回调；回调包含操作者、输入值、更新令牌和原始卡片内容，并可用于替换完整卡片。

查看原文
references/lark-im-card-action-reply.md:31来自说明文档
| `type` | string | Always `card.action.trigger` || `event_id` | string | Unique event ID; safe for deduplication || `timestamp` | string (timestamp_ms) | Event delivery time (ms since epoch) || `operator_id` | string (open_id) | Open ID of the user who interacted || `message_id` | string (message_id) | Message ID of the card (`om_xxx`) || `chat_id` | string (chat_id) | Chat ID (`oc_xxx`) || `host` | string | `im_message` (chat card) or `im_top_notice` (top banner) || `token` | string | Delayed-update token; valid 30 min, max 2 uses || `action_tag` | string | Component type that was triggered (see decision table) || `action_value` | string | Developer-defined value on the component; serialized to JSON string || `action_name` | string | `name` attribute of the component || `timezone` | string | User timezone, e.g. `Asia/Shanghai`; only populated for date/time picker interactions || `form_value` | string (JSON) | All form field values as JSON string, keyed by component `name`; only present when a button inside a form container is clicked || `input_value` | string | Input text; only for standalone `input` components (not inside a form) || `option` | string | Selected value for standalone single-select: `select_static`, `select_person`, `overflow`, `date_picker`, `picker_time`, `picker_datetime` || `options` | string | Comma-separated selected values for standalone multi-select: `multi_select_static`, `multi_select_person` || `checked` | bool | Checkbox state for standalone `checker` elements || `card_content` | string | Original card content (userDSL text format) from when the card was sent; auto-fetched via message get API at consume time; empty if `message_id` absent or fetch fails — skip if empty |
references/lark-im-card-action-reply.md:95来自说明文档
Only enter the auto-update workflow below if the user confirms. If your runtime does notsupport background monitoring, inform the user that automatic card updates are not availableand they will need to handle interactions manually.## Agent workflowWhen a `card.action.trigger` event arrives (**each stdout JSON line is one event — process it immediately**):
从这里开始 · 工作说明SKILL.md
lark-im
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

40 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录61 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/card/lark-im-card-create.md已纳入全文
  • references/lark-im-card-action-reply.md已纳入全文
  • references/lark-im-chat-create.md已纳入全文
  • references/lark-im-chat-list.md已纳入全文
  • references/lark-im-chat-members-list.md已纳入全文
  • references/lark-im-chat-messages-list.md已纳入全文
  • references/lark-im-chat-search.md已纳入全文
  • references/lark-im-chat-update.md已纳入全文
  • references/lark-im-feed-group-list-item.md已纳入全文
  • references/lark-im-feed-group-list.md已纳入全文
  • references/lark-im-feed-group-query-item.md已纳入全文
  • references/lark-im-feed-groups.md已纳入全文
  • references/lark-im-feed-shortcut-create.md已纳入全文
  • references/lark-im-feed-shortcut-list.md已纳入全文
  • references/lark-im-feed-shortcut-remove.md已纳入全文
  • references/lark-im-flag-cancel.md已纳入全文
  • references/lark-im-flag-create.md已纳入全文
  • references/lark-im-flag-list.md已纳入全文
  • references/lark-im-message-enrichment.md已纳入全文
  • references/lark-im-message-read-status.md已纳入全文
  • references/lark-im-messages-edit.md已纳入全文
  • references/lark-im-messages-mget.md已纳入全文
  • references/lark-im-messages-reply.md已纳入全文
  • references/lark-im-messages-resources-download.md已纳入全文
  • references/lark-im-messages-search.md已纳入全文
  • references/lark-im-messages-send.md已纳入全文
  • references/lark-im-reactions.md已纳入全文
  • references/lark-im-threads-messages-list.md已纳入全文
  • references/card/components/button.md已纳入全文
  • references/card/components/chart.md已纳入全文
  • references/card/components/checker.md已纳入全文
  • references/card/components/collapsible_panel.md已纳入全文
  • references/card/components/column_set.md已纳入全文
  • references/card/components/date_picker.md已纳入全文
  • references/card/components/div.md已纳入全文
  • references/card/components/form.md已纳入全文
  • references/card/components/header.md已纳入全文
  • references/card/components/hr.md已纳入全文
  • references/card/components/img_combination.md已纳入全文
  • references/card/components/img.md已纳入全文
  • references/card/components/input.md已纳入全文
  • references/card/components/interactive_container.md已纳入全文
  • references/card/components/markdown.md已纳入全文
  • references/card/components/multi_select_person.md已纳入全文
  • references/card/components/multi_select_static.md已纳入全文
  • references/card/components/overflow.md已纳入全文
  • references/card/components/person_list.md已纳入全文
  • references/card/components/person.md已纳入全文
  • references/card/components/picker_datetime.md已纳入全文
  • references/card/components/picker_time.md已纳入全文
  • references/card/components/recycling_container.md已纳入全文
  • references/card/components/select_img.md已纳入全文
  • references/card/components/select_person.md已纳入全文
  • references/card/components/select_static.md已纳入全文
  • references/card/components/table.md已纳入全文
  • references/lark-im-chat-identity.md已纳入全文
  • references/card/card-2.0-schema.md已纳入全文
  • references/card/lark-im-card-style.md已纳入全文
  • references/card/resource/colors.md已纳入全文
  • references/card/resource/icons.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • references/card/card-2.0-schema.md配套文件
  • references/card/components/button.md配套文件
  • references/card/components/chart.md配套文件
  • references/card/components/checker.md配套文件
  • references/card/components/collapsible_panel.md配套文件
  • references/card/components/column_set.md配套文件
  • references/card/components/date_picker.md配套文件
  • references/card/components/div.md配套文件
  • references/card/components/form.md配套文件
  • references/card/components/header.md配套文件
  • references/card/components/hr.md配套文件
  • references/card/components/img.md配套文件
  • references/card/components/img_combination.md配套文件
  • references/card/components/input.md配套文件
  • references/card/components/interactive_container.md配套文件
  • references/card/components/markdown.md配套文件
  • references/card/components/multi_select_person.md配套文件
  • references/card/components/multi_select_static.md配套文件
  • references/card/components/overflow.md配套文件
  • references/card/components/person.md配套文件
  • references/card/components/person_list.md配套文件
  • references/card/components/picker_datetime.md配套文件
  • references/card/components/picker_time.md配套文件
  • references/card/components/recycling_container.md配套文件
  • references/card/components/select_img.md配套文件
  • references/card/components/select_person.md配套文件
  • references/card/components/select_static.md配套文件
  • references/card/components/table.md配套文件
  • references/card/lark-im-card-create.md配套文件
  • references/card/lark-im-card-style.md配套文件
  • references/card/resource/colors.md配套文件
  • references/card/resource/icons.md配套文件
  • references/lark-im-card-action-reply.md配套文件
  • references/lark-im-chat-create.md配套文件
  • references/lark-im-chat-identity.md配套文件
  • references/lark-im-chat-list.md配套文件
  • references/lark-im-chat-members-list.md配套文件
  • references/lark-im-chat-messages-list.md配套文件
  • references/lark-im-chat-search.md配套文件
  • references/lark-im-chat-update.md配套文件
  • references/lark-im-feed-group-list-item.md配套文件
  • references/lark-im-feed-group-list.md配套文件
  • references/lark-im-feed-group-query-item.md配套文件
  • references/lark-im-feed-groups.md配套文件
  • references/lark-im-feed-shortcut-create.md配套文件
  • references/lark-im-feed-shortcut-list.md配套文件
  • references/lark-im-feed-shortcut-remove.md配套文件
  • references/lark-im-flag-cancel.md配套文件
  • references/lark-im-flag-create.md配套文件
  • references/lark-im-flag-list.md配套文件
  • references/lark-im-message-enrichment.md配套文件
  • references/lark-im-message-read-status.md配套文件
  • references/lark-im-messages-edit.md配套文件
  • references/lark-im-messages-mget.md配套文件
  • references/lark-im-messages-reply.md配套文件
  • references/lark-im-messages-resources-download.md配套文件
  • references/lark-im-messages-search.md配套文件
  • references/lark-im-messages-send.md配套文件
  • references/lark-im-reactions.md配套文件
  • references/lark-im-threads-messages-list.md配套文件

代码和说明中提到的操作

连接外部网站
SKILL.md:40来自说明文档
Prefer CLI-returned links: use `chat_app_link` to open joined conversations, `message_app_link` to open messages, and `share_link` to invite others to groups. If manually building a joined-conversation AppLink, use `https://<applink_host>/client/chat/open?openChatId=<oc_xxx>`, never `chatId=<oc_xxx>` or `lark://...chat_id=<oc_xxx>`.
SKILL.md:246来自说明文档
| `chat.moderation.update` | `im:chat:moderation:write_only` || `chat.join_requests.list` | `im:chat.membership_application:read` || `chat.join_requests.handle` | `im:chat.membership_application:write` |
SKILL.md:247来自说明文档
| `chat.join_requests.list` | `im:chat.membership_application:read` || `chat.join_requests.handle` | `im:chat.membership_application:write` || `+messages-read-status` | user: `im:message:readonly` (recommended), `im:message`, or `im:message:get_as_user` |
运行命令
SKILL.md:137来自说明文档
```bashlark-cli schema im.<resource>.<method>   # 调用 API 前必须先查看参数结构
references/card/lark-im-card-create.md:101来自说明文档
```bash# 发送到群聊
references/lark-im-card-action-reply.md:89来自说明文档
Once the listener is running, check whether your agent runtime supports background eventmonitoring (i.e. can receive and process stdout lines from a running subprocess whilecontinuing to respond to the user). If it does, prompt the user:
读取文件
references/lark-im-messages-edit.md:45来自说明文档
- **`--set-attachments` is a replace, not an append:** the flag values become the final `files` array. Send/reply's `--attachment` merges; edit's `--set-attachments` replaces.- **Mutually exclusive with `--content` carrying files:** when `--content` already contains a `files` array, `--set-attachments` and `--clear-attachments` are rejected — declare the attachment zone either via `--content` or via the attachment flags, not both. Use `--markdown` (which never emits a `files` array) or a `--content` without `files` together with the attachment flags.- The server fills name/size/mime/is_folder from file service metadata; the client does not (and cannot) override the display name.
references/lark-im-messages-send.md:200来自说明文档
> **Mutual exclusivity rule:** `--text`, `--markdown`, `--content`, and `--image`/`--file`/`--video`/`--audio` cannot be used together. Media flags are also mutually exclusive with each other. `--attachment` cannot be combined with a `--content` that already contains a `files` array (the attachment zone is declared either via `--content` or via `--attachment`, not both).>
读取了多少行
5,891
文件校验值（用于核对版本）
31d3ede3d82e8b90938338a26b69af35abe077e6d795b92d03329a700048c771