autumn-add-payments

Warn

Audited by Snyk on Feb 15, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill explicitly integrates with Stripe and exposes payment-specific operations: creating checkout sessions (returns Stripe URL), attaching a product/payment when a card is on file, cancelling/subscribing/upgrading/downgrading plans, and backend usage with a secret key (Autumn SDK calls like autumn.checkout, autumn.attach, autumn.cancel). These are concrete payment gateway actions that initiate and manage financial transactions, not generic tooling.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 15, 2026, 09:11 PM