autumn-setup
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official vendor packages
autumn-js(via npm/yarn/pnpm) andautumn-sdk(via pip). These are standard library installations from established package registries and are owned by the service provider described in the skill. - [COMMAND_EXECUTION]: The skill uses standard package management commands (e.g.,
npm install,pip install) and an initialization commandnpx atmn init. These are expected actions for setting up a software development kit. - [CREDENTIALS_UNSAFE]: The skill correctly advises users to store sensitive information like secret keys in environment variables (e.g.,
process.env.AUTUMN_SECRET_KEY). Example code uses placeholders likeam_sk_test_xxxrather than hardcoded credentials. - [DATA_EXFILTRATION]: Network operations are directed to the official API domain of the service (
api.useautumn.com) for legitimate business purposes (creating customers and managing billing sessions). No unauthorized data exfiltration patterns were observed.
Audit Metadata