github TypeScript analyzed ec1b70a

plosson/agentio

github

One CLI for LLM agents: Gmail, Slack, JIRA, WhatsApp and 14 more — MCP, GitHub Actions, daemon

maintainer: plosson
license: MIT
first seen: 2026-07-05
last seen: 2026-08-01
releases · 30d: 6
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit ec1b70a · analyzer v28 · 1d ago

skills & prompt files 27

danger signals7

suspicious endpoint t.me plosson-agentio-ec1b70a/src/commands/telegram.ts :108 console.error(' -> https://t.me/BotFather\n');
suspicious endpoint api.telegram.org plosson-agentio-ec1b70a/src/services/telegram/client.ts :5 const TELEGRAM_API_BASE = 'https://api.telegram.org/bot';
over-broad OAuth scope https://www.googleapis.com/auth/documents expected for this server's purpose plosson-agentio-ec1b70a/src/auth/oauth.ts :25 'https://www.googleapis.com/auth/documents', // read/write docs
over-broad OAuth scope https://www.googleapis.com/auth/drive expected for this server's purpose plosson-agentio-ec1b70a/src/auth/oauth.ts :37 'https://www.googleapis.com/auth/drive', // full access to all drive files
over-broad OAuth scope https://www.googleapis.com/auth/spreadsheets expected for this server's purpose plosson-agentio-ec1b70a/src/auth/oauth.ts :52 'https://www.googleapis.com/auth/spreadsheets', // full access to spreadsheets
credential in logs credential in log plosson-agentio-ec1b70a/src/commands/daemon.ts :234 console.log(`Generated API key: ${apiKey}`);
credential in logs credential in log plosson-agentio-ec1b70a/src/daemon/daemon.ts :55 console.log(`API Key: ${daemonConfig.apiKey}`);

code evidence vv1.9.1 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 185

filesystem 32

fs plosson-agentio-ec1b70a/src/commands/config.ts :3 import { readFile, writeFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/daemon.ts :2 import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'fs';
fs plosson-agentio-ec1b70a/src/commands/doctor.ts :2 import { existsSync, readdirSync } from 'fs';
fs plosson-agentio-ec1b70a/src/commands/gchat.ts :3 import { readFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/gdocs.ts :2 import { writeFile, readFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/gscript.ts :2 import { readFile, writeFile, readdir, mkdir, stat } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/gsheets.ts :2 import { readFile, writeFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/gslides.ts :2 import { readFile, writeFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/mcp.ts :2 import { readFile, writeFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/schedule.ts :2 import { existsSync } from 'fs';
fs plosson-agentio-ec1b70a/src/commands/setup.ts :2 import { mkdir, copyFile, unlink, readFile as fsReadFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/skill.ts :2 import * as fs from 'fs';
fs plosson-agentio-ec1b70a/src/commands/slack.ts :2 import { readFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/commands/update.ts :5 import * as fs from 'fs';
fs plosson-agentio-ec1b70a/src/config/config-manager.ts :3 import { mkdir } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/daemon/path-migration.ts :1 import { existsSync, renameSync } from 'fs';
fs plosson-agentio-ec1b70a/src/daemon/scheduler-core.ts :1 import { readFileSync } from 'fs';
fs plosson-agentio-ec1b70a/src/daemon/scheduler.ts :2 import { readFile } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/services/claude-plugin/agentio-json.ts :1 import * as fs from 'fs';
fs plosson-agentio-ec1b70a/src/services/gchat/client.ts :3 import { stat } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/services/gchat/directory.ts :1 import { readFile, writeFile, mkdir, stat } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/services/gdrive/client.ts :1 import { writeFile, stat } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/services/schedule/claude-binary.ts :2 import { existsSync } from 'fs';
fs plosson-agentio-ec1b70a/src/services/schedule/runner.ts :2 import { appendFile, mkdir } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/services/schedule/runs.ts :1 import { existsSync, readFileSync, readdirSync } from 'fs';
fs plosson-agentio-ec1b70a/src/services/schedule/state.ts :1 import { existsSync } from 'fs';
fs plosson-agentio-ec1b70a/src/services/schedule/walker.ts :1 import { readdirSync, statSync } from 'fs';
fs plosson-agentio-ec1b70a/src/utils/daemon-ensure.ts :2 import { existsSync } from 'fs';
fs plosson-agentio-ec1b70a/src/vault/migrate.ts :1 import { readFile, rename } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/vault/passphrase.ts :1 import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync } from 'fs';
fs plosson-agentio-ec1b70a/src/vault/pointer.ts :1 import { readFile, writeFile, unlink, mkdir } from 'fs/promises';
fs plosson-agentio-ec1b70a/src/vault/vault.ts :1 import { readFile, writeFile, unlink, rename, mkdir } from 'fs/promises';

shell / exec 8

shell plosson-agentio-ec1b70a/src/auth/oauth-server.ts :35 Bun.spawn([open, url], { stdout: 'ignore', stderr: 'ignore' });
shell plosson-agentio-ec1b70a/src/commands/claude.ts :3 import { spawn } from 'child_process';
shell plosson-agentio-ec1b70a/src/commands/daemon.ts :37 const result = spawnSync({ cmd: ['realpath', path], stdout: 'pipe', stderr: 'pipe' });
shell plosson-agentio-ec1b70a/src/commands/gmail.ts :1043 const result = Bun.spawnSync([
shell plosson-agentio-ec1b70a/src/daemon/scheduler.ts :16 /** injected for tests; defaults to child_process.spawn */
shell plosson-agentio-ec1b70a/src/services/schedule/claude-binary.ts :1 import { execFileSync } from 'child_process';
shell plosson-agentio-ec1b70a/src/services/schedule/runner.ts :1 import { spawn, type ChildProcess } from 'child_process';
shell plosson-agentio-ec1b70a/src/utils/daemon-ensure.ts :54 spawnSync({

network 19

net plosson-agentio-ec1b70a/src/auth/confluence-oauth.ts :46 const response = await fetch(ATLASSIAN_TOKEN_URL, {
net plosson-agentio-ec1b70a/src/auth/github-oauth.ts :37 const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
net plosson-agentio-ec1b70a/src/auth/jira-oauth.ts :41 const response = await fetch(ATLASSIAN_TOKEN_URL, {
net plosson-agentio-ec1b70a/src/auth/oauth-server.ts :1 import { createServer, type Server, type IncomingMessage, type ServerResponse } from 'http';
net plosson-agentio-ec1b70a/src/auth/token-manager.ts :112 const response = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {
net plosson-agentio-ec1b70a/src/commands/gchat.ts :430 const response = await fetch(webhookUrl, {
net plosson-agentio-ec1b70a/src/commands/schedule.ts :158 const res = await fetch(url, {
net plosson-agentio-ec1b70a/src/commands/slack.ts :173 const response = await fetch(webhookUrl, {
net plosson-agentio-ec1b70a/src/commands/update.ts :66 const response = await fetch(url, {
net plosson-agentio-ec1b70a/src/daemon/client.ts :37 const response = await fetch(`${url}/health`, {
net plosson-agentio-ec1b70a/src/services/confluence/client.ts :33 const response = await fetch(`${this.baseV2}/spaces?limit=1`, {
net plosson-agentio-ec1b70a/src/services/discourse/client.ts :121 const response = await fetch(url, {
net plosson-agentio-ec1b70a/src/services/gchat/client.ts :171 const res = await fetch(url, { headers: { Authorization: `Bearer ${token.token}` } });
net plosson-agentio-ec1b70a/src/services/gchat/directory.ts :133 const res = await fetch(
net plosson-agentio-ec1b70a/src/services/github/client.ts :35 const response = await fetch(url, {
net plosson-agentio-ec1b70a/src/services/jira/client.ts :28 const response = await fetch(url, {
net plosson-agentio-ec1b70a/src/services/rss/client.ts :61 const response = await fetch(baseUrl, {
net plosson-agentio-ec1b70a/src/services/slack/client.ts :46 const response = await fetch(webhookUrl, {
net plosson-agentio-ec1b70a/src/services/telegram/client.ts :40 const response = await fetch(url, {

secrets 2

secrets plosson-agentio-ec1b70a/src/commands/config.ts :218 const key = options.key || process.env.AGENTIO_KEY;
secrets plosson-agentio-ec1b70a/src/daemon/client.ts :15 process.env.AGENTIO_DAEMON_API_KEY || await getEnv('AGENTIO_DAEMON_API_KEY');

declared dependencies 23

@modelcontextprotocol/sdk@^1.29.0
@googleapis/calendar@^14.2.0
@googleapis/chat@^44.6.0
@googleapis/docs@^9.2.1
@googleapis/drive@^20.0.1
@googleapis/gmail@^16.1.1
@googleapis/script@^11.0.1
@googleapis/sheets@^13.0.1
@googleapis/slides@^5.0.1
@googleapis/tasks@^12.0.0
@inquirer/prompts@^8.2.0
commander@^14.0.2
google-auth-library@^10.0.0
gray-matter@^4.0.3
libsodium-wrappers@^0.8.1
long@^5.3.2
marked@^18.0.3
plist@^3.1.0
rss-parser@^3.13.0
@types/bun@latest
@types/node@^25.0.3
@types/plist@^3.0.5
typescript@^5.9.3