github Python analyzed 7a35b46

Alksalt/hikari-agent

Personal AI agent on the Claude Agent SDK — bi-temporal fact memory, capability-gated permissions, 15+ MCP servers, ~55 tools, 2,800+ tests.

maintainer: Alksalt
license: —
first seen: 2026-06-10
last seen: 2026-07-29
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-07-30 code analysis flagged committed secret ×2 in Alksalt/hikari-agent

capabilities 5 tools

transport stdio · streamable-http · http counts 5 tools · 0 res · 0 prompts permission surface via code analysis

tools

hikari_lexicon_top
hikari_observations
hikari_open_loops
hikari_recall
hikari_wiki_search

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 7a35b46 · analyzer v28 · 2d ago

skills & prompt files 18

danger signals22

suspicious endpoint api.telegram.org expected for this server's purpose Alksalt-hikari-agent-7a35b46/scripts/dead_man.py :167 r = httpx.head("https://api.telegram.org", timeout=10.0)
suspicious endpoint 169.254.169.254 (cloud metadata) Alksalt-hikari-agent-7a35b46/tests/test_link_shelf_ssrf.py :149 await safe_fetch("http://169.254.169.254/latest/meta-data/")
over-broad OAuth scope https://mail.google.com/ Alksalt-hikari-agent-7a35b46/auth/scope_match.py :16 "https://mail.google.com/": frozenset({
over-broad OAuth scope gmail.modify Alksalt-hikari-agent-7a35b46/auth/scope_match.py :19 "https://www.googleapis.com/auth/gmail.modify",
over-broad OAuth scope https://www.googleapis.com/auth/drive Alksalt-hikari-agent-7a35b46/auth/scope_match.py :34 "https://www.googleapis.com/auth/drive": frozenset({
over-broad OAuth scope https://mail.google.com/ Alksalt-hikari-agent-7a35b46/scripts/auth.py :62 "https://mail.google.com/",
over-broad OAuth scope https://www.googleapis.com/auth/drive Alksalt-hikari-agent-7a35b46/scripts/auth.py :64 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope https://www.googleapis.com/auth/documents Alksalt-hikari-agent-7a35b46/scripts/auth.py :65 "https://www.googleapis.com/auth/documents",
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets Alksalt-hikari-agent-7a35b46/scripts/auth.py :66 "https://www.googleapis.com/auth/spreadsheets",
over-broad OAuth scope https://mail.google.com/ Alksalt-hikari-agent-7a35b46/tests/test_auth_scopes.py :219 return _StubResp({"scope": "https://mail.google.com/ https://www.googleapis.com/auth/calendar"})
over-broad OAuth scope https://mail.google.com/ Alksalt-hikari-agent-7a35b46/tests/test_google_auth_preflight.py :20 "https://mail.google.com/",
over-broad OAuth scope https://www.googleapis.com/auth/drive Alksalt-hikari-agent-7a35b46/tests/test_google_auth_preflight.py :22 "https://www.googleapis.com/auth/drive",
over-broad OAuth scope https://www.googleapis.com/auth/documents Alksalt-hikari-agent-7a35b46/tests/test_google_auth_preflight.py :23 "https://www.googleapis.com/auth/documents",
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets Alksalt-hikari-agent-7a35b46/tests/test_google_auth_preflight.py :24 "https://www.googleapis.com/auth/spreadsheets",
over-broad OAuth scope gmail.modify Alksalt-hikari-agent-7a35b46/tests/test_google_auth_preflight.py :67 assert "https://www.googleapis.com/auth/gmail.modify" in missing
over-broad OAuth scope https://mail.google.com/ Alksalt-hikari-agent-7a35b46/tests/test_phase_g_oauth.py :85 "scope": "https://mail.google.com/ https://www.googleapis.com/auth/calendar",
over-broad OAuth scope gmail.modify Alksalt-hikari-agent-7a35b46/tests/test_phase_g_oauth.py :479 return {"https://www.googleapis.com/auth/gmail.modify"}
over-broad OAuth scope gmail.modify Alksalt-hikari-agent-7a35b46/tests/test_scope_match.py :18 "https://www.googleapis.com/auth/gmail.modify",
over-broad OAuth scope https://mail.google.com/ Alksalt-hikari-agent-7a35b46/tests/test_scope_match.py :19 {"https://mail.google.com/"},
over-broad OAuth scope https://www.googleapis.com/auth/drive Alksalt-hikari-agent-7a35b46/tests/test_scope_match.py :46 {"https://www.googleapis.com/auth/drive"},
committed secret Anthropic key Alksalt-hikari-agent-7a35b46/tests/test_audit_redaction_widened.py :17 sk-ant…(43 chars, redacted)
committed secret Anthropic key Alksalt-hikari-agent-7a35b46/tests/test_log_scrub.py :71 sk-ant…(44 chars, redacted)

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 605

filesystem 45

fs Alksalt-hikari-agent-7a35b46/agents/config.py :20 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/engagement/producers/wiki_new_file.py :9 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/evening_diary.py :21 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/future_letter.py :30 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/health.py :32 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/jobhunt_context.py :64 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/mail_handoff.py :21 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/mcp_manager.py :24 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/messaging.py :12 import pathlib
fs Alksalt-hikari-agent-7a35b46/agents/reflection.py :13 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/runtime.py :21 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/subagents/research_worker.py :13 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/system_prompt.py :13 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/telegram_bridge.py :19 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/tool_inventory.py :18 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/agents/upstream_health.py :28 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/auth/notion.py :198 webbrowser.open(auth_url)
fs Alksalt-hikari-agent-7a35b46/evals/conversation/judge.py :18 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/evals/conversation/runner.py :12 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/evals/conversation/runner_layer_b.py :9 import pathlib
fs Alksalt-hikari-agent-7a35b46/evals/conversation/runner_layer_c.py :19 import pathlib
fs Alksalt-hikari-agent-7a35b46/evals/conversation/scorer.py :11 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/evals/flip/harness.py :19 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/mcp_external/launch.py :276 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/storage/db.py :31 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/storage/graph.py :18 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/_tools_yaml.py :25 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/attachments/read.py :10 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/calc/_shared.py :18 import pathlib
fs Alksalt-hikari-agent-7a35b46/tools/calc/python_run.py :14 import pathlib
fs Alksalt-hikari-agent-7a35b46/tools/catalog.py :23 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/day_receipt/_db.py :27 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/day_receipt/_shared.py :17 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/dispatch/_shared.py :20 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/jobhunt/drafter.py :51 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/jobhunt/lint.py :34 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/jobhunt/readers.py :60 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/jobhunt/reply_radar.py :36 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/photos/__init__.py :17 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/photos/classify.py :24 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/skills/core.py :18 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/voice.py :27 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/voice_outbound.py :10 import shutil
fs Alksalt-hikari-agent-7a35b46/tools/wiki/_shared.py :20 from pathlib import Path
fs Alksalt-hikari-agent-7a35b46/tools/wiki/list.py :9 from pathlib import Path

shell / exec 4

shell Alksalt-hikari-agent-7a35b46/agents/mail_handoff.py :19 import subprocess
shell Alksalt-hikari-agent-7a35b46/tools/calc/python_run.py :15 import subprocess
shell Alksalt-hikari-agent-7a35b46/tools/jobhunt/readers.py :57 import subprocess
shell Alksalt-hikari-agent-7a35b46/tools/wiki/_shared.py :18 import subprocess

network 21

net Alksalt-hikari-agent-7a35b46/agents/google_health.py :20 import httpx
net Alksalt-hikari-agent-7a35b46/agents/runtime.py :23 import httpx
net Alksalt-hikari-agent-7a35b46/agents/telegram_bridge.py :1474 import httpx
net Alksalt-hikari-agent-7a35b46/auth/github.py :20 import httpx
net Alksalt-hikari-agent-7a35b46/auth/google.py :28 import httpx
net Alksalt-hikari-agent-7a35b46/auth/notion.py :38 from urllib.parse import parse_qs, urlencode, urlparse
net Alksalt-hikari-agent-7a35b46/evals/conversation/judge.py :21 import httpx
net Alksalt-hikari-agent-7a35b46/evals/conversation/scorer.py :14 import httpx
net Alksalt-hikari-agent-7a35b46/mcp_external/oauth.py :33 from urllib.parse import urlencode, urlparse
net Alksalt-hikari-agent-7a35b46/mcp_external/server.py :164 from urllib.parse import urlparse
net Alksalt-hikari-agent-7a35b46/tools/approvals.py :31 import httpx # noqa: F401 — kept for third-party consumers that may import from here
net Alksalt-hikari-agent-7a35b46/tools/currency/convert.py :25 import httpx # noqa: PLC0415
net Alksalt-hikari-agent-7a35b46/tools/link_shelf/_safe_fetch.py :4 ``httpx.AsyncClient(follow_redirects=True)``, which means a user (or a
net Alksalt-hikari-agent-7a35b46/tools/link_shelf/handlers.py :16 from urllib.parse import urlparse
net Alksalt-hikari-agent-7a35b46/tools/location.py :23 import httpx
net Alksalt-hikari-agent-7a35b46/tools/photos/classify.py :27 import httpx
net Alksalt-hikari-agent-7a35b46/tools/places/_shared.py :107 import httpx # noqa: PLC0415
net Alksalt-hikari-agent-7a35b46/tools/translate/_shared.py :30 import httpx # noqa: PLC0415 — lazy: network dep only loaded when this backend runs
net Alksalt-hikari-agent-7a35b46/tools/voice.py :29 import httpx
net Alksalt-hikari-agent-7a35b46/tools/voice_outbound.py :16 import httpx
net Alksalt-hikari-agent-7a35b46/tools/weather/_sources.py :31 import httpx # noqa: PLC0415 — lazy: keep registry import cheap

secrets 19

secrets Alksalt-hikari-agent-7a35b46/agents/google_health.py :53 "client_secret": os.environ["GOOGLE_WORKSPACE_CLIENT_SECRET"],
secrets Alksalt-hikari-agent-7a35b46/agents/proactive.py :528 token = os.environ.get("TELEGRAM_BOT_TOKEN")
secrets Alksalt-hikari-agent-7a35b46/agents/runtime.py :463 api_key = os.environ.get("OPENROUTER_API_KEY", "")
secrets Alksalt-hikari-agent-7a35b46/agents/scheduler.py :758 token = os.environ.get("TELEGRAM_BOT_TOKEN")
secrets Alksalt-hikari-agent-7a35b46/agents/telegram_bridge.py :2469 token = os.environ.get("TELEGRAM_BOT_TOKEN")
secrets Alksalt-hikari-agent-7a35b46/auth/github.py :46 pat: The raw Personal Access Token string (from getpass or stdin).
secrets Alksalt-hikari-agent-7a35b46/auth/google.py :130 client_secret = os.environ.get("GOOGLE_WORKSPACE_CLIENT_SECRET")
secrets Alksalt-hikari-agent-7a35b46/auth/notion.py :251 if os.environ.get("NOTION_TOKEN"):
secrets Alksalt-hikari-agent-7a35b46/auth/providers.py :161 self._token = os.environ.get("NOTION_TOKEN") or ""
secrets Alksalt-hikari-agent-7a35b46/auth/store.py :65 import keyring # noqa: F401 — validate available at construction time
secrets Alksalt-hikari-agent-7a35b46/evals/conversation/judge.py :62 key = api_key or os.environ.get("OPENROUTER_API_KEY")
secrets Alksalt-hikari-agent-7a35b46/evals/conversation/runner_layer_c.py :110 api_key = os.environ.get("OPENROUTER_API_KEY")
secrets Alksalt-hikari-agent-7a35b46/evals/conversation/scorer.py :87 key = api_key or os.environ.get("OPENROUTER_API_KEY")
secrets Alksalt-hikari-agent-7a35b46/storage/graph.py :112 api_key = os.environ.get("OPENROUTER_API_KEY")
secrets Alksalt-hikari-agent-7a35b46/tools/photos/classify.py :205 os.environ.get("CLAUDE_CODE_OAUTH_TOKEN", "").strip()
secrets Alksalt-hikari-agent-7a35b46/tools/translate/_shared.py :32 api_key = os.environ.get("DEEPL_API_KEY")
secrets Alksalt-hikari-agent-7a35b46/tools/translate/translate.py :51 if not os.environ.get("DEEPL_API_KEY") and _public_lt in _lt_endpoint:
secrets Alksalt-hikari-agent-7a35b46/tools/voice_outbound.py :90 api_key = os.environ.get("ELEVENLABS_API_KEY")
secrets Alksalt-hikari-agent-7a35b46/tools/weather/_sources.py :195 api_key = os.environ.get("OPENWEATHERMAP_API_KEY")

database 9

db Alksalt-hikari-agent-7a35b46/agents/annual_review.py :14 import sqlite3
db Alksalt-hikari-agent-7a35b46/agents/future_letter.py :28 import sqlite3
db Alksalt-hikari-agent-7a35b46/agents/upstream_health.py :26 import sqlite3
db Alksalt-hikari-agent-7a35b46/storage/db.py :24 import sqlite3
db Alksalt-hikari-agent-7a35b46/storage/graph.py :16 import sqlite3
db Alksalt-hikari-agent-7a35b46/storage/migrations.py :19 import sqlite3
db Alksalt-hikari-agent-7a35b46/tools/day_receipt/_db.py :21 import sqlite3
db Alksalt-hikari-agent-7a35b46/tools/jobhunt/readers.py :56 import sqlite3
db Alksalt-hikari-agent-7a35b46/tools/link_shelf/db.py :19 import sqlite3

tool registrations 5

hikari_recall Alksalt-hikari-agent-7a35b46/mcp_external/server.py :190
hikari_lexicon_top Alksalt-hikari-agent-7a35b46/mcp_external/server.py :210
hikari_observations Alksalt-hikari-agent-7a35b46/mcp_external/server.py :237
hikari_open_loops Alksalt-hikari-agent-7a35b46/mcp_external/server.py :270
hikari_wiki_search Alksalt-hikari-agent-7a35b46/mcp_external/server.py :288

declared dependencies 19

claude-agent-sdk@>=0.2.110
python-telegram-bot@>=21.0
apscheduler@>=3.10
httpx@>=0.27
pyyaml@>=6.0
python-dotenv@>=1.0
fastembed@>=0.4
sqlite-vec@>=0.1.6
obsidiantools@>=0.10
python-frontmatter@>=1.1
ruamel.yaml@>=0.18
pykakasi@>=2.3.0
asteval@>=1.0.8
arxiv@>=4.0.0
osm-opening-hours-humanized@>=1.0.0b7
ytmusicapi@>=1.12.0
itsdangerous@>=2.2.0
pillow@>=10.0
keyring@>=24