T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup-webhook.sh:6- Finding
Persistent Disclosure of Sensitive Meeting Data to an Arbitrary Webhook Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Fathom
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it says, but its webhook setup can continuously send sensitive meeting content to any user-supplied HTTPS endpoint with broad defaults.
Review the webhook feature carefully before installing. Use the read-only listing, summary, and transcript scripts only with meetings you are authorized to access. Do not run setup-webhook.sh unless you control the destination endpoint, understand that transcripts, summaries, and action items may be sent there for future recordings, and are prepared to delete the webhook later. Store the Fathom API key securely and rotate it if exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a read/search integration, yet it also documents webhook registration, outbound configuration to arbitrary user-specified HTTPS endpoints, and management of webhook secrets. That is materially different from passive retrieval and can cause ongoing external transmission of sensitive meeting data.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a read/search integration, yet it also documents webhook registration, outbound configuration to arbitrary user-specified HTTPS endpoints, and management of webhook secrets. That is materially different from passive retrieval and can cause ongoing external transmission of sensitive meeting data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script allows an operator to register any arbitrary HTTPS endpoint as a destination and enables transcript, summary, and action-item delivery for multiple recording scopes. In the context of a skill described only as fetching meetings and call history, this creates a clear exfiltration path for sensitive meeting content to third-party infrastructure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents shell commands and outbound API access but does not declare any explicit tool scope such as allowed tools or permissions. That increases the chance an agent can invoke shell/network capabilities more broadly than intended, which is risky in a skill that handles meeting transcripts and API keys.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill retrieves and exports highly sensitive meeting artifacts—transcripts, summaries, and potentially recordings—without warning about privacy, consent, retention, or organizational policy implications. In this context, missing warnings make accidental overcollection or improper sharing more likely.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The setup recommends persisting a long-lived API key in a local file or environment variable, which creates session persistence and increases the blast radius if the workstation, shell history, or environment is compromised. Given the skill accesses sensitive meeting data, persistent credentials deserve stronger handling guidance.
- Content
md ### 1. Get Your API Key 1. Go to [developers.fathom.ai](https://developers.fathom.ai) 2. Create an API key 3. Copy the key (format: `v1XDx...`) ### 2. Configure
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Option A: Store in file (recommended) echo "YOUR_API_KEY" > ~/.fathom_api_key chmod 600 ~/.fathom_api_key # Option B: Environment variable export FATHOM_API_KEY="YOUR_API_KEY"
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation extends the skill from meeting retrieval into automatic transcript ingestion via webhooks. In a context involving call transcripts and summaries, that expansion increases data exposure because users may not expect persistent forwarding of sensitive conversations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The webhook setup command enables outbound integration to an external endpoint outside the manifest's apparent read/search scope. Because meeting transcripts may contain confidential business or personal information, hidden or under-disclosed sync behavior materially raises confidentiality risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The webhook instructions omit a warning that enabling auto-ingestion may continuously transmit future meeting data to an external service. For meeting transcripts and action items, this can create silent, persistent exfiltration of sensitive information well beyond a one-time fetch.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script materially expands the skill from passive retrieval of meeting data into active configuration of outbound webhooks that can continuously export future meeting content. That capability is outside the stated purpose and increases risk because it creates a persistence mechanism for ongoing data disclosure rather than a one-time fetch operation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "" # Register webhook RESPONSE=$(curl -s -X POST "https://api.fathom.ai/external/v1/webhooks" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d "{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The registration flow sends configuration that will cause Fathom to deliver potentially sensitive transcripts and summaries externally, but the script presents this as a simple setup step without prominent privacy or data-sharing warnings. Users may not understand that they are enabling ongoing transfer of confidential meeting data to another service.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh echo " 1. Get your API key from https://developers.fathom.ai" echo " 2. Save it:" echo " echo 'YOUR_KEY' > ~/.fathom_api_key" echo " chmod 600 ~/.fathom_api_key" echo "" echo " Or set environment variable:" echo " export FATHOM_API_KEY='YOUR_KEY'"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh RESPONSE=$(curl -s -w "\n%{http_code}" \ -H "X-API-Key: $API_KEY" \ "https://api.fathom.ai/external/v1/meetings?limit=1") HTTP_CODE=$(echo "$RESPONSE" | tail -n1) BODY=$(echo "$RESPONSE" | sed '$d')
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes fetching recordings, transcripts, and summaries from Fathom, which justifies calling the Fathom API. However, this script also implements credential discovery by reading both the FATHOM_API_KEY environment variable and ~/.fathom_api_key from the local filesystem, which is a separate capability not mentioned in the manifest.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code accesses sensitive credentials via the FATHOM_API_KEY environment variable or a ~/.fathom_api_key file, but provides no warning, prompt, or explanatory comment that the script will read stored secrets. Under the code-file criteria, sensitive credential access should have some visible disclosure unless clearly covered elsewhere.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The script performs a curl request to api.fathom.ai using an API key, which transmits credentialed request data over the network. Although this is aligned with the script's purpose of listing Fathom calls, there is no explicit warning in the help/output/comments that it contacts the external Fathom service using the stored key.
- Content
Static analysis
No suspicious patterns detected.