One file, two listings: verifying lark-doc against the GitHub source we said did not exist

We spent this morning doing something boring, and it turned up a correction we owe our own readers.

We run a directory of agent skills. In August we published a deep dive on lark-doc, ByteDance's skill for driving Lark (Feishu) documents from a coding agent, and the dive opened with a sourcing note saying the skill had no public repository, so there was no commit to pin quotes to. Today we went looking for the upstream file again before quoting it. The repo has been public since March.

Here is what the check found, what changed in the file since August, and the four-command recipe so you can run it on anything you install.

The short version

The lark-doc SKILL.md that Feishu serves from its own domain is byte-identical to skills/lark-doc/SKILL.md in the MIT-licensed larksuite/cli repo. Both are 4,192 bytes over 49 lines and both hash to 2786f910370662069b1b52b98508033c84baaf0bd7b0bae177426ece4ceafacc. We fetched both on 13 September 2026. Two listings carry that same file with different install counts.

Two listings, two counts, and no total

	Vendor namespace	GitHub namespace
Install command	npx skills add https://open.feishu.cn --skill lark-doc	npx skills add https://github.com/larksuite/cli --skill lark-doc
All-time installs	663,945	439,469
Figure stamped as of	September 12, 2026	September 7, 2026
Repo stars shown	none	17k

Both numbers come from the skills.sh registry, and we read both pages on 13 September 2026. The gap is 224,476, which makes the vendor-namespace count about 1.5 times the GitHub one.

We are not going to add them for you. The Lark Doc skill page on Skillselion carries a notice that reads, verbatim as it rendered on 13 September 2026:

This is a copy of lark-doc by larksuite - installs and ranking accrue to the original listing.

What we can observe is that our catalog holds a separate record per install path and that the registry reports a different number against each. How an install gets attributed between them is not something we can see from outside, so this post carries no combined audience figure.

Byte-identical duplicates across namespaces are common enough that we measured them. Our Agent Skill Clone Census report, frozen on 2026-08-12, content-matched 79,848 listings and found 3,443 verified copies holding 26,061,541 installs, 15.8% of every install counted. The census test for a copy is a byte-identical SKILL.md. That is exactly the test lark-doc passes here, and the census found publishers re-listing their own work account for 35.0% of those copy-installs, a bigger slice than anyone ripping anyone off.

How do you check a skill file against its repo?

Four steps, about thirty seconds, curl and shasum only.

1. Hash what you were served.

curl -sS https://open.feishu.cn/.well-known/skills/lark-doc/SKILL.md | shasum -a 256
# 2786f910370662069b1b52b98508033c84baaf0bd7b0bae177426ece4ceafacc

1. Get the current head SHA from the GitHub API. Never quote from a moving branch.

curl -sS "https://api.github.com/repos/larksuite/cli/commits?per_page=1" | jq -r '.[0].sha'
# 39aaf9fca0e08825b51f6d8c6c617bf781db761b

1. Fetch the same path at that exact SHA.

curl -sS "https://raw.githubusercontent.com/larksuite/cli/39aaf9fca0e08825b51f6d8c6c617bf781db761b/skills/lark-doc/SKILL.md" | shasum -a 256

1. diff them. Match means you can cite a pinned commit. Mismatch means the repo wins, because that is what the author currently says, and the difference itself is worth writing down.

Step 2 is the one people skip, and it is the one that matters. A permalink to main drifts off the lines it quotes the next time anybody touches the file. Your citation then points at the wrong sentence and nothing tells you.

While you are there, check the endpoint's headers. The vendor response carried no ETag and no Last-Modified, so there is nothing on that surface to pin a citation to even if you wanted to.

What the file actually says

At commit 39aaf9f, skills/lark-doc/ holds 44 files: the SKILL.md, 15 reference files, and 28 document-genre templates under references/genres/. The SKILL.md is 49 lines and does almost nothing but route between them. The repo ships 28 directories with a SKILL.md in them and carries 17,151 stars and 1,381 forks under MIT (GitHub API, 13 September 2026).

The frontmatter declares dependencies as machine-readable metadata instead of prose:

metadata:
  requires:
    bins: ["lark-cli"]
    skills: ["lark-shared"]

Source: skills/lark-doc/SKILL.md, frontmatter, commit 39aaf9f, read 13 September 2026

A binary and a sibling skill, checkable before anything lands on disk. Compare that to the usual "make sure you have X installed" sentence halfway down a README.

The first body instruction is about context budget, not documents:

**CRITICAL：先判断场景，再读取该场景的参考文件；不要在任务开始时一次性读取全部参考文件。每个文件只在首次进入对应阶段时读取一次。**

Source: skills/lark-doc/SKILL.md, "场景与 Shortcut 路由", commit 39aaf9f, read 13 September 2026

Our translation: "CRITICAL: judge the scenario first, then read that scenario's reference file; do not read all the reference files at once when the task starts. Read each file only once, on first entering its stage." With 43 reference files behind a 49-line router, that is the whole design.

The best line in the file is in the routing entry for writing a document from scratch:

- **从零创作 — [`创建工作流`](references/lark-doc-create-workflow.md)**：先完整执行创建工作流，**简单任务不是跳过的理由**；

Source: skills/lark-doc/SKILL.md, "文档内容", commit 39aaf9f, read 13 September 2026

"A simple task is not a reason to skip it." Somebody watched an agent decide a job was too small for the process and ship something malformed, then wrote a rule about it.

The auth handling runs backwards from most skills, and we think it is the right call. The file tells the agent not to pre-read the shared auth skill and not to pre-run auth status --verify, and to load it only after an unauthenticated, token, identity or scope error, then retry. Most skills pay an auth check on every single run forever. This one pays it once, on failure.

One line changed since our August dive

Our deep dive verified its quotes on 20 August 2026. Between 525a98270f80693bdaf3c0a6006e9f3f94820851 (2026-08-14, the last change before that) and today's head, diff returns exactly one changed line. Line 19, the rule for resolving local file paths.

It went from a single sentence pinning @path references to the current working directory, to a four-clause rule with a lookup order, a fallback to the source XML file's directory, and an explicit list of inputs that get no fallback at all (inline content, stdin, online documents). It arrived in commit 9a29abea on 2026-09-09. The file grew from 4,009 to 4,192 bytes and stayed at 49 lines.

Two things worth reading off that rule rather than around it: local references widened from CWD-relative only to absolute paths anywhere on disk, and on a filename collision the copy in the working directory wins, silently.

Our own catalog copy still shows the older line. Four days behind, confirmed by reading our listing page on 13 September 2026. That lag is precisely why the rule in our process is to re-fetch upstream before quoting, and it is the rule that caught our own error today.

What we got wrong in August

The August dive says "this skill has no public repository" and "There is no commit history to pin". Both wrong. skills/lark-doc/SKILL.md has been public since 2026-03-28, in the commit that open-sourced lark-cli as the official Lark and Feishu CLI. Forty commits have touched that one file since then.

What went wrong is mundane. We checked the vendor's .well-known endpoint, saw no version handle, and stopped looking instead of searching GitHub for a distinctive line of the file. Thirty seconds of searching would have found it. The dive stays useful and its quotes still hold, but its sourcing note is wrong, and this post is where we say so. The index is at the Skillselion deep dive series index.

Should you install it?

If your documents live in Lark or Feishu, yes, and take the suite rather than this one node. lark-doc deliberately does not handle file-level operations or comments, which belong to the Lark Drive agent skill page, and it does not touch spreadsheets or Base tables.

One thing to read before you run the install command. Our GitHub-namespace listing shows a security audit of 2 of 3 scanners passed, sourced from the skills.sh audit and read on 13 September 2026. That is not a red flag by itself, but check the Security Audits panel on the listing before this goes anywhere near production.

If you do not use Lark, skip it. Every capability assumes ByteDance's ecosystem, from the CLI binary to the URL formats it routes on.

Prefer the GitHub install path either way. Same bytes, plus a diff for every future change. If the term itself is new to you, we keep a plain definition on the Skillselion agent skill glossary entry, and the listing that carries the repository, the stars and the security audit panel is the larksuite/cli Lark Doc skill listing.

Run the four commands on the next skill you install. It takes thirty seconds and it is the only thing standing between you and quoting a file nobody can check.

Verified against larksuite/cli at commit 39aaf9fca0e08825b51f6d8c6c617bf781db761b and against the vendor-served SKILL.md on 13 September 2026. Install figures carry the as-of date stamped by the page they came from. Translations from the Chinese are ours. Skillselion is an independent directory and is not affiliated with ByteDance, Lark, Anthropic, OpenAI or Cursor.