docs(mail): document sender allow and block APIs#1938
Conversation
Make the generated sender-list operations discoverable with accurate read and write scope guidance.
github-actions
Bot
added
domain/mail
📝 WalkthroughWalkthrough扩展邮件技能的工作流、安全确认、发送与撤回说明，新增 HTML lint、模板、快捷命令、API 资源及权限表文档，并补充收件人搜索、别名发送和多草稿发送指导。 ChangesMail skill documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/lark-mail/SKILL.md`:
- Line 521: Update the +draft-send entry in the skills index to document its
required --yes confirmation gate and the preview behavior when confirmation is
omitted, matching the shortcut implementation’s contract; if the implementation
differs, align both to one exact flag and behavior.
- Around line 301-309: Update the calendar-invite example in the mail send
command to use a date after July 17, 2026, while keeping the event’s start/end
times and all other example arguments consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| lark-cli mail +send --as user \ | ||
| --to alice@example.com --cc bob@example.com \ | ||
| --subject '产品评审' \ | ||
| --body '<p>请参加本次产品评审会议。</p>' \ | ||
| --event-summary '产品评审' \ | ||
| --event-start '2026-05-10T14:00+08:00' \ | ||
| --event-end '2026-05-10T15:00+08:00' \ | ||
| --event-location '5F 大会议室' \ | ||
| --confirm-send |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use a future date in the calendar-invite example.
2026-05-10 is already in the past as of July 17, 2026. Copying this example can produce an invalid or rejected calendar invitation.
Proposed fix
- --event-start '2026-05-10T14:00+08:00' \
- --event-end '2026-05-10T15:00+08:00' \
+ --event-start '2027-05-10T14:00+08:00' \
+ --event-end '2027-05-10T15:00+08:00' \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| lark-cli mail +send --as user \ | |
| --to alice@example.com --cc bob@example.com \ | |
| --subject '产品评审' \ | |
| --body '<p>请参加本次产品评审会议。</p>' \ | |
| --event-summary '产品评审' \ | |
| --event-start '2026-05-10T14:00+08:00' \ | |
| --event-end '2026-05-10T15:00+08:00' \ | |
| --event-location '5F 大会议室' \ | |
| --confirm-send | |
| lark-cli mail +send --as user \ | |
| --to alice@example.com --cc bob@example.com \ | |
| --subject '产品评审' \ | |
| --body '<p>请参加本次产品评审会议。</p>' \ | |
| --event-summary '产品评审' \ | |
| --event-start '2027-05-10T14:00+08:00' \ | |
| --event-end '2027-05-10T15:00+08:00' \ | |
| --event-location '5F 大会议室' \ | |
| --confirm-send |
🧰 Tools
🪛 SkillSpector (2.3.11)
[error] 32: [P1] Instruction Override: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Remediation: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
(Prompt Injection (P1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/lark-mail/SKILL.md` around lines 301 - 309, Update the calendar-invite
example in the mail send command to use a date after July 17, 2026, while
keeping the event’s start/end times and all other example arguments consistent.
| | [`+reply-all`](references/lark-mail-reply-all.md) | Reply to all recipients and save as draft (default). Use --confirm-send to send immediately after user confirmation. Includes all original To and CC automatically. | | ||
| | [`+send`](references/lark-mail-send.md) | Compose a new email and save as draft (default). Use --confirm-send to send immediately after user confirmation. | | ||
| | [`+draft-create`](references/lark-mail-draft-create.md) | Create a brand-new mail draft from scratch (NOT for reply or forward). For reply drafts use +reply; for forward drafts use +forward. Only use +draft-create when composing a new email with no parent message. | | ||
| | [`+draft-send`](references/lark-mail-draft-send.md) | Send one or more existing mail drafts sequentially. Calls POST /drafts/:draft_id/send for each input ID, isolates per-draft failures, and aggregates the results. Use after the drafts have already been created (via the Lark client, +draft-create, or the drafts.create API). | |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Document the required confirmation gate for +draft-send.
The shortcut implementation is a high-risk write requiring --yes, but this row only says to send drafts and does not document that gate. Agents following this reference could attempt an unauthorised send or use the wrong confirmation flag. State the exact required flag and preview/confirmation behavior here, or align the implementation and documentation on one contract.
🧰 Tools
🪛 SkillSpector (2.3.11)
[error] 32: [P1] Instruction Override: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
Remediation: Remove or rewrite any text that instructs the agent to ignore prompts, override safety rules, or trust unverified content. Ensure skill content cannot be injected to alter agent behavior.
(Prompt Injection (P1))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/lark-mail/SKILL.md` at line 521, Update the +draft-send entry in the
skills index to document its required --yes confirmation gate and the preview
behavior when confirmation is omitted, matching the shortcut implementation’s
contract; if the implementation differs, align both to one exact flag and
behavior.
🚀 PR Preview Install Guide🧰 CLI updatenpm i -g https://pkg.pr.new/larksuite/cli/@larksuite/cli@08381ad9b8417de4713aaf783126d3b1c5f77a97🧩 Skill updatenpx skills add infeng/cli#feat/0a93e67 -y -g |
1 participant
Documents the generated sender allow-list and block-list API resources so they are discoverable to CLI users and agents.
Validation:
Summary by CodeRabbit