sales-fathom
Integrates Fathom AI note-taking capabilities with CRMs and data warehouses, enabling seamless access to meeting transcripts and action items.
Install this skill
Security score
The sales-fathom skill was audited on Jun 3, 2026 and we found 19 security issues across 3 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 77 | - **Webhook signatures use Svix-style HMAC-SHA256** with three headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`). The secret string starts with `whsec_` — strip that prefix and base64-d |
Template literal with variable interpolation in command context
| 125 | **Solution**: `base64.b64decode(secret.split('_')[1])` — HMAC the signed content `${webhook-id}.${webhook-timestamp}.${raw_body}` (must be raw body, NOT JSON-parsed-and-re-serialized), base64-encode t |
Webhook reference - potential data exfiltration
| 3 | description: "Fathom AI note-taker platform help — REST API for pulling meeting transcripts, summaries, action items, and CRM matches into CRMs, data warehouses, or Slack. Use when transcripts not syn |
Webhook reference - potential data exfiltration
| 18 | - B) Build a backend integration (API, webhooks, OAuth, SDK) |
Webhook reference - potential data exfiltration
| 19 | - C) Troubleshoot webhook delivery / HMAC signature verification |
Webhook reference - potential data exfiltration
| 46 | | Anything Fathom-platform-specific (API, webhooks, pricing, integrations, bot behavior) | Stay here | |
Webhook reference - potential data exfiltration
| 54 | **Read `references/fathom-api-reference.md`** for verbatim API docs — endpoints, request/response schemas, OAuth flow, webhook HMAC verification, rate limits, SDK methods. |
Webhook reference - potential data exfiltration
| 62 | 1. **For API/webhook questions** — give a concrete code snippet (cURL, Python, or TypeScript based on user's stack), note the auth header or OAuth scope required, and flag the 60-req/min rate limit if |
Webhook reference - potential data exfiltration
| 63 | 2. **For transcript pipeline design** — recommend webhook-first (create one via `POST /webhooks` with `include_transcript=true` and the right `triggered_for` array) and fall back to polling `GET /meet |
Webhook reference - potential data exfiltration
| 75 | - **Create-webhook requires at least one of `include_transcript`, `include_crm_matches`, `include_summary`, or `include_action_items`** to be `true`. An empty payload is rejected. |
Webhook reference - potential data exfiltration
| 77 | - **Webhook signatures use Svix-style HMAC-SHA256** with three headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`). The secret string starts with `whsec_` — strip that prefix and base64-d |
Webhook reference - potential data exfiltration
| 95 | **User says**: "I built a webhook receiver for Fathom but transcripts aren't showing up in Snowflake — webhooks hit but payload looks wrong" |
Webhook reference - potential data exfiltration
| 97 | 1. Confirms webhook was created with `include_transcript=true` (otherwise payload has no transcript body) |
Webhook reference - potential data exfiltration
| 99 | 3. Recommends a reconcile-poll pattern: daily `GET /meetings?created_after={yesterday}` to catch any webhook deliveries that failed |
Webhook reference - potential data exfiltration
| 101 | **Result**: Correct webhook payload shape + reconcile-poll fallback so no transcripts get lost. |
Webhook reference - potential data exfiltration
| 123 | ### Webhook fires but signature verification fails |
Webhook reference - potential data exfiltration
| 125 | **Solution**: `base64.b64decode(secret.split('_')[1])` — HMAC the signed content `${webhook-id}.${webhook-timestamp}.${raw_body}` (must be raw body, NOT JSON-parsed-and-re-serialized), base64-encode t |
Base64 decode operation
| 77 | - **Webhook signatures use Svix-style HMAC-SHA256** with three headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`). The secret string starts with `whsec_` — strip that prefix and base64-d |
Base64 decode operation
| 125 | **Solution**: `base64.b64decode(secret.split('_')[1])` — HMAC the signed content `${webhook-id}.${webhook-timestamp}.${raw_body}` (must be raw body, NOT JSON-parsed-and-re-serialized), base64-encode t |