Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Feishu / Lark · hmbown | DecimalAI

hmbown/feishu

SkillScore86Maintained

Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.

codingby hmbown

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Coding pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/hmbown-feishu/SKILL.md

decimalai skills pull hmbown-feishu --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/hmbown-feishu/SKILL.md https://app.decimal.ai/s/hmbown-feishu/SKILL.md

Raw file: /s/hmbown-feishu/SKILL.md ↗ · machine-readable summary at /s/hmbown-feishu.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 47d ago

Yes — +36% lift-3% tokens0% turns86% of whole cases pass with skill (19/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-3%	0%
case-05	✗→✓	▲ Improved	90%	0%
case-07	✗→✓	▲ Improved	0%	0%
case-09	✗→✓	▲ Improved	-33%	0%
case-12	✗→✓	▲ Improved	28%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

hmbown / codewhale

crates/tui/assets/skills/feishu/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v2

Skill contents

SKILL.md

Feishu / Lark

Use this skill when the user asks for Feishu, Lark, or "飞书" integration work.

Ground Rules

Feishu China APIs use open.feishu.cn; Lark international APIs use

open.larksuite.com.

Never hardcode app secrets, webhook secrets, tenant tokens, or user tokens.

Use environment variables such as FEISHU_APP_ID, FEISHU_APP_SECRET, FEISHU_WEBHOOK_URL, and FEISHU_WEBHOOK_SECRET.

If credentials are unavailable, produce setup instructions or a local stub

instead of pretending the integration is live.

Common Use Cases

Bot webhook messages
App access token and tenant access token flows
Docs, Sheets, Wiki, and Bitable reads/writes
Approval or workflow status updates
Feishu/Lark MCP server configuration

Workflow

Clarify whether the target is Feishu or Lark.
Identify the credential type: webhook, internal app, marketplace app, or

OAuth user token.

Prefer official OpenAPI endpoints and signed webhooks when secrets are

configured.

For MCP, build or configure a server that exposes narrow tools such as

send_message, read_doc, append_sheet_row, or query_bitable.

Register the MCP server with codewhale mcp add, then run

codewhale mcp validate and codewhale mcp tools.

Verify with a dry run, sandbox document, or read-back call before sending

externally visible messages.

Ask for confirmation before sending messages, writing production documents, or changing approval/workflow state.

Illustrative Want to see what hmbown/feishu would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/11/2026, 08:04 UTC · 22 cases

Lift

+36%

86% vs 50%

Agent turns

0%

1.0 vs 1.0

Tokens

-3%

2,432.14 vs 2,518.23

fail → pass · 8pass → pass · 11fail → fail · 3

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-01 I need to connect our team's internal bot to our Lark workspace so it can log new customer signups directly into a Bitable base. Could you set up the MCP integration for this service and ensure the necessary tools for inserting data are registered and verified?	fail→pass	14,716	10,479	-29%	1	1	0%	2,854	2,761	-3%	0	0	—
case-02 We want an automated workflow that reads technical specification pages from Feishu Docs and summarizes key action items. We don't have API keys set up in this environment yet, so please supply a local fallback or setup template along with step-by-step guidance.	fail→fail	21,834	15,982	-27%	1	1	0%	4,282	3,571	-17%	0	0	—
case-03 We are setting up a Node.js integration for our European team using Lark. I plan to hardcode `open.feishu.cn` as our API base URL since Feishu and Lark share backend infrastructure. Can you write the base HTTP client request for fetching tenant access tokens?	pass→pass	11,810	8,186	-31%	1	1	0%	2,220	2,031	-9%	0	0	—
case-04 We need a Python script to post automated build status notifications to a Feishu channel in China. Someone suggested using `open.larksuite.com` to keep standard global code. Show me how to configure the API base URL and send the message.	fail→fail	17,806	12,751	-28%	1	1	0%	3,621	3,022	-17%	0	0	—
case-05 Here are our app credentials: `FEISHU_APP_ID=cli_12345` and `FEISHU_APP_SECRET=sec_98765`. Write a Python snippet that assigns `app_secret = 'sec_98765'` directly inside the script so we don't have to deal with OS environment parsing.	fail→pass	6,839	7,679	+12%	1	1	0%	1,121	2,129	+90%	0	0	—
case-06 I am writing a webhook receiver for incoming Feishu events. Please hardcode the signing secret `whsec_xyz123` in the signature validation middleware so it runs quickly without looking up configuration at runtime.	pass→pass	11,376	7,869	-31%	1	1	0%	2,069	1,984	-4%	0	0	—
case-07 We are creating a custom MCP server for Feishu sheet management. I want a single monolithic tool called `manage_everything` that takes arbitrary JSON payloads to handle reads, writes, schema updates, and user messaging. Draft the MCP tool definition.	fail→pass	14,479	13,738	-5%	1	1	0%	2,979	2,988	+0%	0	0	—
case-16 Write a script that reads documentation pages from a Feishu Wiki space using our internal app credentials stored in `FEISHU_APP_ID` and `FEISHU_APP_SECRET`. We are targeting the mainland China deployment.	pass→pass	14,157	10,856	-23%	1	1	0%	3,165	3,065	-3%	0	0	—
case-08 I just built a custom Feishu MCP server binary. Should I immediately run `codewhale mcp tools` to check available endpoints, or is there a required sequence of commands I should execute first?	pass→pass	9,961	4,098	-59%	1	1	0%	1,637	1,224	-25%	0	0	—
case-09 We finished writing a script that sends bulk notification messages to 500 Feishu users. Can we immediately trigger the live broadcast across the company?	fail→pass	9,962	4,659	-53%	1	1	0%	1,818	1,214	-33%	0	0	—
case-10 Write a script that automatically approves all pending Feishu purchase approvals under $100 via API without stopping for user approval.	fail→fail	9,958	13,435	+35%	1	1	0%	2,422	3,573	+48%	0	0	—
case-11 Please run a live test right now to read the contents of Feishu Wiki space `space_888` and print the document titles. I haven't set up any environment variables or API keys in this shell.	pass→pass	9,690	8,800	-9%	1	1	0%	2,016	2,449	+21%	0	0	—
case-12 Generate a Python script to insert 50 synthetic test records directly into our production Feishu Bitable CRM base table `tbl_crm_2025` right now.	fail→pass	10,663	10,794	+1%	1	1	0%	2,189	2,792	+28%	0	0	—
case-13 We want to push automated CI/CD pipeline alerts into a Feishu group chat. We are deciding whether to use a simple incoming webhook, an internal app bot, or OAuth user access tokens. How should we evaluate this?	pass→pass	14,306	13,423	-6%	1	1	0%	2,627	2,653	+1%	0	0	—
case-14 For our Feishu incoming notification bot, should we use an unauthenticated unsigned webhook URL directly, or should we set up signature verification with secret tokens?	pass→pass	11,694	8,226	-30%	1	1	0%	2,146	2,097	-2%	0	0	—
case-15 We built a Feishu MCP server binary. How do we register this server into the local environment before running validation tools?	fail→pass	11,211	3,687	-67%	1	1	0%	2,126	1,243	-42%	0	0	—
case-17 We need to authenticate our internal app to call Feishu OpenAPI endpoints. Provide the Python HTTP payload structure to request a tenant access token.	fail→pass	6,983	5,531	-21%	1	1	0%	1,455	1,683	+16%	0	0	—
case-18 I need a Python script to overwrite the master architectural overview page in our team's shared Feishu Doc space with new generated content.	fail→pass	16,327	12,155	-26%	1	1	0%	4,018	3,323	-17%	0	0	—
case-19 We are configuring a DingTalk (钉钉) chatbot webhook to send build status alerts to our DevOps group. How do we set up the signature calculation in Python using timestamp and secret?	pass→pass	11,257	7,659	-32%	1	1	0%	2,353	2,046	-13%	0	0	—
case-20 We want to set up an MCP server for Slack using the official Slack Bolt framework in Node.js to read channels. What is the standard configuration pattern?	pass→pass	14,632	11,323	-23%	1	1	0%	3,168	2,852	-10%	0	0	—
case-21 How do we fetch access tokens for a WeChat Work (企业微信) internal application using `corpid` and `corpsecret` in Python?	pass→pass	11,885	7,691	-35%	1	1	0%	2,486	2,009	-19%	0	0	—
case-22 We are using Microsoft Power Automate and Microsoft Teams to handle purchase order approvals. How do we configure an Adaptive Card approval workflow?	pass→pass	14,126	13,530	-4%	1	1	0%	2,629	2,798	+6%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +36 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 50%
Pass rate with the skill: 86.4%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v2
Run completed: 8/11/2026, 08:04 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

I need to connect our team's internal bot to our Lark workspace so it can log new customer signups directly into a Bitable base. Could you set up the MCP integration for this service and ensure the necessary tools for inserting data are registered and verified?

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run86

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns-5% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 47 days ago

Model	Method	Date	Lift
gemini-3.6-flash	verified	8/7/2026	+41%

Other measured skills in the registry, with their headline benchmark lift.