skills/useautumn/skills/autumn-setup/Gen Agent Trust Hub

autumn-setup

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to create billing configurations and drive CLI actions. Ingestion points: Pricing details are gathered from user messages, external pricing pages, or project README files (SKILL.md). Boundary markers: There are no specific instructions or delimiters provided to the agent to treat user-provided data as untrusted or to ignore embedded instructions. Capability inventory: The skill possesses extensive capabilities including executing shell commands via atmn and npx, and writing to configuration files like autumn.config.ts and .env (SKILL.md). Sanitization: No explicit sanitization, validation, or filtering of the external content is described before it is used to generate code or configurations.
  • [REMOTE_CODE_EXECUTION]: The skill downloads and executes remote code as part of its setup process. Execution method: Installs additional agent components using the command npx skills add useautumn/skills -y (SKILL.md). Execution method: The initialization process installs the atmn CLI tool as a dependency using npx, pnpm, yarn, or bunx (SKILL.md).
  • [COMMAND_EXECUTION]: The skill performs multiple shell operations to manage the platform's lifecycle. Details: Runs commands like atmn init, atmn login, and atmn push to connect the project to the Autumn service and synchronize configurations (SKILL.md). Details: Automatically identifies the system's package manager to execute these tools (SKILL.md).
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources from external endpoints managed by the vendor. Details: Fetches configuration and performs provisioning via https://api.useautumn.com (references/keyless.md). Details: Downloads skill definitions from the useautumn/skills repository (SKILL.md).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 10:50 PM
Security Audit — agent-trust-hub — autumn-setup