Lark Notice Sender
Purpose
This SkillRun capsule sends text messages to Feishu (Lark) chats through the official lark-cli. It demonstrates how an external CLI tool with 200+ commands can be contracted down to a single, bounded action with explicit preflight guards, dry-run defaults, and audit artifacts.
This is not a general Feishu adapter. It does not expose calendars, docs, sheets, or meetings. It only sends messages, and only under strict conditions.
SOP
- Accept only
chat_id values from an explicit allowlist.
- Reject messages containing secrets, API keys, passwords, or private keys.
- Default to
dry_run=true: generate a preview artifact without sending.
- Only send live messages when
dry_run=false and all preflight checks pass.
- Record every attempt (dry-run or live) as a markdown artifact for audit.
- Do not silently fail: if
lark-cli is missing or unauthenticated, return a structured error.
Prerequisites
lark-cli must be installed and authenticated (lark-cli auth status should succeed).- The environment variable
LARK_NOTICE_ALLOWLIST must be set to a comma-separated list of allowed chat IDs (e.g., oc_xxx,oc_yyy).
- The capsule requires outbound network access to
open.feishu.cn or open.larksuite.com.
Recovery Guidance
- If
lark-cli is not found, install it: npx @larksuite/cli@latest install and run lark-cli auth login.
- If
chat_id is rejected, check LARK_NOTICE_ALLOWLIST.
- If content is rejected for sensitive words, remove secrets or tokens from the message body.
1---2name: lark-notice-sender3description: Lark Notice Sender4---5# Lark Notice Sender67## Purpose89This SkillRun capsule sends text messages to Feishu (Lark) chats through the official `lark-cli`. It demonstrates how an external CLI tool with 200+ commands can be **contracted down to a single, bounded action** with explicit preflight guards, dry-run defaults, and audit artifacts.1011This is not a general Feishu adapter. It does not expose calendars, docs, sheets, or meetings. It only sends messages, and only under strict conditions.1213## SOP14151. Accept only `chat_id` values from an explicit allowlist.162. Reject messages containing secrets, API keys, passwords, or private keys.173. Default to `dry_run=true`: generate a preview artifact without sending.184. Only send live messages when `dry_run=false` and all preflight checks pass.195. Record every attempt (dry-run or live) as a markdown artifact for audit.206. Do not silently fail: if `lark-cli` is missing or unauthenticated, return a structured error.2122## Prerequisites2324- `lark-cli` must be installed and authenticated (`lark-cli auth status` should succeed).25- The environment variable `LARK_NOTICE_ALLOWLIST` must be set to a comma-separated list of allowed chat IDs (e.g., `oc_xxx,oc_yyy`).26- The capsule requires outbound network access to `open.feishu.cn` or `open.larksuite.com`.2728## Recovery Guidance2930- If `lark-cli` is not found, install it: `npx @larksuite/cli@latest install` and run `lark-cli auth login`.31- If `chat_id` is rejected, check `LARK_NOTICE_ALLOWLIST`.32- If content is rejected for sensitive words, remove secrets or tokens from the message body.
iiwish