Borrowing it
Nothing to install: this file belongs to henryxm/autumn. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/henryxm/autumn/master/.cursor/skills/autumn-framework-2x/SKILL.mdgit clone --depth 1 https://github.com/henryxm/autumnWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/henryxm/autumn/autumn-framework-2x)<a href="https://agentmods.dev/skills/henryxm/autumn/autumn-framework-2x"><img src="https://agentmods.dev/badge/skills/henryxm/autumn/autumn-framework-2x/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/henryxm/autumn/autumn-framework-2x"><img src="https://agentmods.dev/badge/skills/henryxm/autumn/autumn-framework-2x.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 12 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00724 | $0.08678 |
| Opus 5 | $0.00362 | $0.04339 |
| Sonnet 5 | $0.00145 | $0.01736 |
| Haiku 4.5 | $0.00072 | $0.00868 |
Grade A, and why
autumn-framework-2x scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- autumn-framework-3x — 86% identical, 103 lines differ
How it starts
The opening of the file, as written. The whole thing — 293 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Autumn 2.x 框架开发（2.0.0 / master）
版本矩阵（本 Skill 唯一适用）
| 项 | 版本 / 约束 |
|---|---|
| Autumn | 2.0.0（cn.org.autumn:*:2.0.0，master 分支） |
| JDK | 1.8（勿按 JDK 17+ / var / 新 API 写法改本线代码） |
| Spring Boot | 2.7.18（父 POM spring-boot-starter-parent） |
| MyBatis-Plus | 2.x（与 Boot 2.7 栈一致；以根 pom.xml 属性为准） |
| Java EE 命名空间 | javax.*（非 jakarta.*） |
| 3.x 线 | 禁用本 Skill：Autumn 3.0.0、JDK 17+、Spring Boot 3.5.x 等请用 autumn-framework-3x（在 3.0.0 分支合并并实现后使用） |
业务工程须在 AGENTS.md 或首轮对话中写明依赖的 Autumn 主版本，避免 2.x / 3.x 规范混用。
何时启用
- 当前工作区是 autumn 仓库且检出 master（或维护 2.0.0 标签/分支），或业务工程 Maven 依赖锁定
cn.org.autumn2.0.0。 - 提到：
cn.org.autumn、ModuleService、gen、Dao、Provider、RuntimeSql、DatabaseType、statics、pages、Site、PageAware、autumn.table等，且 栈为 JDK8 + Boot 2.7。 - 提到：机器人 / Bot /
rbt_/ Hook 回调 /message/push/cn.org.autumn.modules.bot/RobotMessageSubscriber（见下文 机器人模块）。
约束扫描（按需）
默认不跑：用户未提及规范体检、合并/CI 自检、constraints-scan、约束扫描等时，不要把执行 scripts/constraints-scan 当作本 Skill 的必做步骤。
何时执行：用户或任务明确要求对仓库做与 docs/AI_STANDARDS.md / docs/AI_DATABASE.md 对齐的分组体检、或声明 CI/合并门禁需要脚本结果时，再在任务根目录实际执行（勿只读文档代替执行）。
-
命令
- 本仓库：工作区根执行
bash scripts/constraints-scan（或bash scripts/constraints-scan .）。 - 业务仓库且并列 clone 了 autumn：
bash ../autumn/scripts/constraints-scan /path/to/business-root（路径按实际调整）；若无脚本则从 autumn 仓库拷贝。 - 依赖：
rg（ripgrep）；可选AUTUMN_SCAN_SKIP_GEN=1、AUTUMN_SCAN_EXTRA=1、AUTUMN_SCAN_SKIP_REDIS=1（见脚本头注释）。
- 本仓库：工作区根执行
-
解读输出
- 按分组 A～H 阅读（H 为 Redis TTL）；对照
docs/AI_DATABASE.md§8.5 与docs/AI_STANDARDS.md。 - 区分真实违规与误报（注释、测试、
target/、历史生成代码等）。F 组仅为 gen 路径清单，不计入 TOTAL。
- 按分组 A～H 阅读（H 为 Redis TTL）；对照
-
修复与收尾
- 任务范围内可确定的违规：直接改代码；超出范围的在回复中列为残留风险。
- 若本次已跑过扫描且改过相关文件，可再跑一次确认未引入新的可修复项（仍属按需，非默认）。
文档加载顺序
所有 AI_*.md 均在仓库 docs/ 下。本仓库内用 @docs/...；业务工程与 autumn 并列时用 @../autumn/docs/...（见 docs/AI_INDEX.md §4）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 293 lines · 724 tokens per session scan A d491f4327708
autumn-framework-2x is a skill published in the GitHub repository henryxm/autumn (49 stars, last pushed 14d ago), licensed Apache-2.0. It adds 724 tokens to every session and 8,678 once invoked, about $0.0036 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
alibaba-java-coding-guidelines-skill
A set of rules for reviewing, generating, and refactoring Java code against Alibaba Java Coding Guidelines, a published style and quality guide. It also covers related Spring, MyBatis, Maven, SQL, database, logging, error-handling, and security code.
azure-security-keyvault-secrets-java
Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.
azure-ai-anomalydetector-java
Build anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate/multivariate anomaly detection, time-series analysis, or AI-powered monitoring.
azure-communication-chat-java
Build real-time chat applications with Azure Communication Services Chat Java SDK. Use when implementing chat threads, messaging, participants, read receipts, typing notifications, or real-time chat features.
azure-communication-common-java
Azure Communication Services common utilities for Java. Use when working with CommunicationTokenCredential, user identifiers, token refresh, or shared authentication across ACS services.
union-type-wrappers
Add typed getters and setters over BinaryData properties that represent TypeSpec union types in generated Java models. Use when generated classes expose BinaryData for union-typed fields and you need ergonomic, type-safe accessors instead.