Garmin Sync Cn To Global

Sync activities from Garmin China to Garmin Global using local timestamps and distance to avoid duplicates in a one-way sync process.

Security Scan

The skill's code and instructions are internally consistent with its stated purpose (one‑way Garmin CN → Global activity sync); it does store your Garmin credentials in plaintext and asks you to install a third‑party pip package, so follow the precautions in the guidance before using it.

Purpose & Capability

The script, SKILL.md, and description all describe the same functionality: logging into Garmin CN and Garmin Global using email/password, downloading activity .fit files from CN and uploading them to Global. Required artifacts (the garth library, credentials) match the stated purpose and there are no unrelated credential or binary requests.

Instruction Scope

SKILL.md instructs installing the garth pip library, saving email/password to ~/.config/garmin-sync/credentials.json, and running a CLI-like command; the included sync.py implements that behavior. This is within scope, but the instructions explicitly store credentials in plaintext and rely on a pip package (supply‑chain risk), which should be noted before running.

Install Mechanism

There is no automated install spec in the registry bundle (instruction-only install). The SKILL.md asks the user to run `pip install garth` manually; the bundle itself does not download or execute external code at install time. The manual pip step is expected for a Python script but carries usual pip supply‑chain considerations.

Credentials

No environment variables or unrelated credentials are requested, which is appropriate. However, the tool stores user email/password in plaintext at ~/.config/garmin-sync/credentials.json (documented in SKILL.md and implemented in code). Storing long‑lived credentials in plaintext is a proportionality/security concern — the script requires credentials for its purpose, but the storage method is risky.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide agent settings, and only writes its own config/state files under ~/.config/garmin-sync and temporary files under /tmp. Privilege/persistence is limited to the user's home directory and /tmp.

Assessment

This skill appears to do what it claims (one‑way sync from Garmin China to Garmin Global) and the code matches the README, but take precautions before running: 1) Review the sync.py source yourself (or have someone you trust do it) to ensure it hasn't been tampered with. 2) The tool stores your Garmin email/password in plaintext at ~/.config/garmin-sync/credentials.json — use a dedicated or throwaway Garmin account for testing and set strict permissions (chmod 600) as advised. Consider using an OS keyring or encrypted vault instead of plaintext. 3) The SKILL.md instructs you to run `pip install garth` — verify the garth package is the legitimate library you expect (check the package project page, author, and release history) before installing. 4) Be aware the script writes a temporary zip to /tmp using a predictable filename; if you run it on a multi-user system, consider running in a sandbox or adjusting the temp path to reduce symlink/race risks. 5) If you want to expose this as a CLI entrypoint, ensure the installed entrypoint matches the provided instructions (the bundle only contains sync.py). If anything about provenance (homepage, owner, or source) is unclear, prefer not to run with your main account until you are comfortable with the code and dependencies.

Sync activities from Garmin China (garmin.cn) to Garmin Global/International (garmin.com).

Usage

# Install dependencies
pip install garth

# Set credentials (once, stored in ~/.config/garmin-sync/credentials.json)
garmin-sync set-credentials --email your_email --password your_password

# Sync new activities from CN to Global
garmin-sync sync

Requirements

• Python 3.x
• garth library (pip install garth)

Notes

• One-way sync: CN → Global (not bidirectional)
• Uses startTimeLocal + distance to detect duplicates (activity IDs differ between servers)
• Skips conflicts automatically
• Same email/password works for both Garmin CN and Garmin Global accounts

Security Considerations

• Credentials are stored in plaintext at ~/.config/garmin-sync/credentials.json
• Set restrictive file permissions after first run: chmod 600 ~/.config/garmin-sync/credentials.json
• Consider using a dedicated/sandbox account for testing
• Review the code before running with your primary credentials