fathom-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and code snippets follow security best practices for SaaS integrations.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were identified; the skill correctly advises using a secrets manager and environment variables for sensitive API keys and secrets.
- [INDIRECT_PROMPT_INJECTION]: The skill addresses potential data processing risks with the following evidence chain: (1) Ingestion points: MeetingQuerySchema and verifyFathomWebhook process external data fields; (2) Boundary markers: Not explicitly present; (3) Capability inventory: Read, Write, Edit, and Grep tools; (4) Sanitization: Zod-based validation and a redactFathomLog pipeline to scrub PII and enforce data structure.
Audit Metadata