fathom-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The provided validation script ingests data from environment variables (
FATHOM_API_KEY,FATHOM_WEBHOOK_URL) to perform connectivity checks. This is a standard integration testing pattern and does not represent a malicious injection risk in this context. - [COMMAND_EXECUTION]: The skill contains a TypeScript snippet for readiness validation. This script performs network connectivity tests to the official Fathom API (
api.fathom.video) and a user-defined webhook endpoint. It does not execute arbitrary shell commands or access sensitive local file paths. - [DATA_EXPOSURE]: The skill correctly recommends storing the Fathom API key in a secrets manager rather than environment files. The validation script uses the key solely for authenticating requests to the official service provider.
Audit Metadata