Security audit
Security checks for vulnerabilities and agentic risk
This Garmin sync skill appears purpose-aligned, but it has a real command-injection flaw and handles sensitive account and activity data with weak scoping.
Review before installing. This is not judged malicious, but it should be fixed to use execFileSync or spawnSync with validated numeric arguments, pin the garminconnect dependency, narrow triggers, add an explicit sync confirmation, and document where tokens and FIT files are stored and how to delete them.
index.js:34Shell Command Injection Through Unvalidated Handler Parameters
scripts/garmin_sync.py:204ZIP Path Traversal When Extracting Downloaded FIT Files
SKILL.md:15Unpinned Third-Party Dependency Creates Supply-Chain Exposure
The skill declares environment-variable and local file storage requirements but does not explicitly scope or document its tool permissions. That creates an authorization and transparency gap: a host may grant broader capabilities than users expect, while the skill handles highly sensitive credentials, OAuth tokens, and downloaded FIT activity files.
The triggers are broad enough to match common conversations about Garmin devices, syncing, sports data, or watches, causing accidental invocation of a credentialed sync workflow. In this context, unintended activation is more dangerous because the skill is designed to access two accounts and persist local artifacts during synchronization.
The description and warnings do not clearly disclose that OAuth tokens are persisted locally and FIT files are cached on disk. This weakens informed consent and can lead users to expose sensitive health/activity data and long-lived authentication material without understanding the local data-retention risk.
The skill reads Garmin usernames and passwords from environment variables and injects them into the Python subprocess environment. While the code comments describe configuration, there is no explicit user-facing warning in this file about handling credentials or transmitting them to another process.
User-facing messages and the skill description are presented in Chinese, and the file does not offer any language selection or opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicit and justified.
The sync routine downloads user activity FIT files from one Garmin account and uploads them to another, which is a privacy-relevant network transfer of personal fitness data. Although the module docstring states what the tool does, the executable sync path contains no confirmation prompt or explicit user-facing warning before performing the transfer.
The trigger '佳明' is very short and likely to match benign discussion unrelated to account synchronization. Because this skill performs authenticated cross-account data transfer, accidental invocation could expose account metadata or prompt unintended sync operations.
The trigger '同步' is generic and commonly used in many unrelated contexts, making false activation likely. In a skill that handles credentials, downloads data, and uploads to another account, unintended routing to this skill increases privacy and operational risk.
The trigger '手表' is too generic and can match ordinary conversation about watches or wearables. Although the direct impact is limited, the skill context raises risk because activation may lead into workflows involving stored credentials and health/activity data.
The code defines a state file path in the user's home directory (~/.garmin-sync/sync-state.json), indicating persistent local file writes. This file does not clearly warn users that local sync state will be stored on disk.
The subprocess is launched with execSync using a shell command string built from args.join(' '), which creates a command-injection risk if any argument contains shell metacharacters. Here, user-influenced values such as days and maxActivities are interpolated into arguments, so a crafted object input could execute arbitrary shell commands with the skill’s privileges.
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal