Fathom

Do not install or run this skill without addressing the issues below. The included sync script will read local secret files (Fathom API key and Google OAuth client/refresh token) and will upload meeting metadata and action items to a hard-coded Supabase URL using an embedded service key. That means your meeting transcripts, attendee emails, and action items could be sent to a third-party database you do not control. If you need this functionality: (1) Ask the author to declare required secrets and config paths in the registry metadata; (2) Remove any hard-coded remote keys/URLs and replace them with configurable endpoints so you can use your own database/service; (3) Only provide Google OAuth tokens with minimal scopes and review the code to ensure it only requests needed calendar data; (4) Run the sync script in an isolated environment or inspect & modify it to avoid sending transcripts off‑site; (5) If you do not trust the author or cannot run the script locally under your control, do not grant it access to your secrets or run it. Because the registry claims no required credentials while the code clearly needs sensitive tokens and pushes data externally, treat this skill as suspicious and verify/correct these issues before use.