# Manage Lark CLI Authentication Safely

Lark CLI setup and permission failures can be difficult to diagnose. This skill provides structured authentication, identity, approval, and token-routing workflows.

## Install

```bash
npx skillstore add larksuite/lark-shared
```

## Metadata

- Status: approved
- Slug: larksuite-lark-shared
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r2
- Version status: valid
- Tree hash: b50ccbc1d9afa10567d7b4964f6a3b88347e1c1931d8488badfffa0646be0ee6
- Author: larksuite
- GitHub username: larksuite
- License: MIT
- Repository: https://github.com/larksuite/cli/tree/main/skills/lark-shared/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, external\_commands
- Quality score: 77
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/larksuite-lark-shared
- Manifest: https://skillstore.pages.dev/api/skills/larksuite-lark-shared/manifest

## Capabilities

- Initializes Lark CLI application configuration and presents authorization links with QR codes.
- Checks user and bot identity, login status, token validity, and granted scopes.
- Starts scoped user authorization through domain, scope, and split device-code flows.
- Explains bot and user permission errors using returned scope and console details.
- Handles structured success, error, update notice, and confirmation-required responses.
- Routes Wiki node tokens to the correct underlying Lark resource skill.

## Use Cases

- Set Up Developer Authentication: Initialize Lark CLI, complete scoped user authorization, and verify the resulting identity and token.
- Resolve Workspace Permission Errors: Distinguish user and bot scope failures, then identify the correct console or authorization action.
- Build Safer Lark Automations: Interpret structured responses, preview risky operations, and preserve confirmation gates before writes.

## Prompt Templates

### Check Login Status

```
Check my current Lark CLI login status and active identity. Verify the token, then summarize granted scopes without exposing secrets.
```

### Initialize Lark CLI

```
Initialize a new Lark CLI application configuration. Start the process in the background, then show the unchanged authorization URL and QR code.
```

### Diagnose Missing Permissions

```
Diagnose this Lark CLI permission error: [paste error]. Identify the active identity and recommend the minimum required scope or administrator action.
```

### Review a Risky Operation

```
Preview this Lark operation with dry-run: [operation]. Explain its risk and parameters, then wait for explicit approval before any confirmed retry.
```

## Limitations

- Requires lark-cli to be installed and an application configuration to be available.
- Cannot grant bot scopes; an administrator must enable them in the Lark developer console.
- User authorization requires an interactive browser or QR-code confirmation.
- Cannot revoke one server-side scope through the CLI; users may need the authorization management page.

## Best Practices

- Request the smallest domain or scope that satisfies the task.
- Verify the active user or bot identity before diagnosing access failures.
- Use dry-run and obtain explicit approval before retrying high-risk writes.

## Anti Patterns

- Do not expose application secrets, access tokens, device codes, or cached authorization links.
- Do not run user authorization for bot identities or assume bots can access personal resources.
- Do not append confirmation flags before the user explicitly approves the displayed high-risk action.

## Security Audit

- Audited at: 2026-07-23T16:57:55.376\+00:00
- Summary: All 76 static findings are false positives caused by Markdown formatting, documented CLI examples, multilingual text, and a placeholder URL. The files contain no executable Ruby or Go source, hidden payload, prompt injection, or data-exfiltration intent.

## Stats

- Views: 114
- Downloads: 13
- Favorites: 0
- Popularity score: 0