Security audit

garmin-ultimate-frisbee-analysis

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it handles Garmin credentials and sensitive health/location data with several unsafe defaults that users should review before installing.

Review before installing. Use a virtual environment, pin dependencies, avoid putting your Garmin password in shell profiles or command-line arguments, protect or delete generated HTML/JSON/FIT/GPX files, and treat dashboards as containing sensitive health and location data. Prefer offline/bundled chart assets or integrity-checked scripts before viewing private reports.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/frisbee_chart.py:297
Finding: Unescaped Garmin and User-Controlled Values Permit Script Injection in Generated Dashboards
Content: View full analysis
No activities found in this date range." rows = "" for i, a in enumerate(activities, 1): dur = int((a.get("duration_seconds") or 0) // 60) hrr_count = len(a.get("hrr", [])) hrr_note = f"✓ {hrr_count} pts" if hrr_count else "—" rows += f""" Game {i} {a.get('date', '—')} {a.get('activity_name', '—')} {a.get('activity_type', '—')} {dur} min {a.get('avg_hr') or '—'} {a.get('max_hr') or '—'} {a.get('calories') or '—'} {hrr_note} """ ``` ```python def generate_tournament_html(data): name = data.get("name", "Tournament") start = data.get("start_date", "") end = data.get("end_date", "") title = f"{name} | {start} → {end}" ... charts_json = json.dumps({"stats": stats, "charts": charts}) return f""" ... {title} ...

🥏 {name}

{start} → {end} · Generated {generated}
... {activity_table} ``` The comparison dashboard contains the same class of issue: ```python table_rows = "" for a in all_relevant: table_rows += f"""
{a['date']} {a['name'][:20]} {a.get('category','—')} {a['dur ...[truncated 2149 chars]
Remediation: View remediation
` element and read it using `textContent`, while escaping `<`, `>`, `&`, U+2028, and U+2029. 4. Alternatively, serialize data to a separate local JSON file and parse it as data rather than executable source. 5. Add a restrictive Content Security Policy that disallows inline event handlers and limits outbound connections. 6. Add regression tests using values containing ``, ``, quotes, ampersands, and Unicode line separators. ]]>

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unbounded Dependency Versions Create a Supply-Chain Execution Risk
Content: View full analysis
=0.2.19 fitparse>=3.2.0 gpxpy>=1.3.5 ``` The documentation incorrectly describes these constraints as pinned: ```markdown # Install dependencies (versions pinned in requirements.txt) pip3 install -r requirements.txt ``` ### Technical Analysis The `>=` operator permits pip to install any future release of each package. Consequently, installations performed after the Skill was reviewed may execute dependency code that was not part of the audited artifact. Python package installation can run package build logic, and the installed packages subsequently execute in the same process as the Skill. In particular, `garminconnect` operates in a process that handles the user's Garmin password, reusable session tokens, and sensitive health data. The absence of package hashes also means the installer does not cryptographically verify that it received the exact reviewed distributions. ### Attack Path 1. A dependency account, package index, release process, or future package version is compromised. 2. The attacker publishes a malicious version satisfying the broad `>=` constraint. 3. The user installs or reinstalls the Skill. 4. Pip resolves the malicious release and executes its installation logic or imports it during normal Skill operation. 5. The dependency accesses the process environment, Garmin credentials, stored session tokens, health information, and files available to the installing user. ### Impact Assessment A malicious dependency would execute native Python code with the privileges of the user running installation or the Skill. It could steal Garmin credentials and session tokens, access health and GPS data, alter generated results, or modify any files writable by that user. If installation is run with elevated privileges, the impact could extend to the bro ...[truncated 18 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:18
Finding: Installer Bypasses Python Environment Protections and May Modify Shared Packages
Content: View full analysis
/dev/null; then echo "✓ Dependencies installed (--user)" elif pip3 install --break-system-packages -r requirements.txt 2>/dev/null; then echo "✓ Dependencies installed (--break-system-packages)" elif pip3 install -r requirements.txt 2>/dev/null; then echo "✓ Dependencies installed (system-wide)" else echo "❌ Failed to install Python dependencies" echo " Try manually: pip3 install --user -r requirements.txt" exit 1 fi ``` ### Technical Analysis If the per-user installation fails, the script automatically invokes pip with `--break-system-packages`. This option deliberately bypasses protections for externally managed Python installations. It then makes another installation attempt without either user isolation or a virtual environment. These fallbacks can overwrite or conflict with packages used by unrelated applications. Redirecting standard error to `/dev/null` also conceals the reason for fallback execution and suppresses security-relevant warnings. This behavior is not necessary for Garmin analytics; an isolated virtual environment provides all required functionality without changing a shared interpreter. ### Attack Path 1. The user runs `install.sh`. 2. The initial `--user` installation fails because of environment policy, dependency conflicts, or local configuration. 3. Without obtaining explicit confirmation, the script retries with `--break-system-packages`. 4. Pip modifies an externally managed or shared Python environment if the current account has sufficient permission. 5. Updated or conflicting packages affect other Python applications, or a compromised dependency gains access to the br ...[truncated 404 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/garmin_auth.py:108
Finding: Credential Guidance and CLI Options Expose the Garmin Password
Content: View full analysis
environment variables if not email or not password: email = email or os.getenv("GARMIN_EMAIL") password = password or os.getenv("GARMIN_PASSWORD") if not email or not password: print("❌ Email and password required", file=sys.stderr) print("Set via:", file=sys.stderr) print(" 1. CLI: --email and --password", file=sys.stderr) print(" 2. Env vars: GARMIN_EMAIL and GARMIN_PASSWORD", file=sys.stderr) sys.exit(1) ``` The setup instructions recommend persistent plaintext storage: ```bash export GARMIN_EMAIL="your-email@example.com" export GARMIN_PASSWORD="your-password" ``` The installer similarly instructs users to add the values to `~/.zshrc` or `~/.bashrc`. ### Technical Analysis Supplying a password through `--password` places it in the process argument vector. Depending on operating-system policy, process arguments may be visible through process inspection, diagnostics, audit logs, crash reports, or monitoring systems. The command can also remain in shell history. Persisting `GARMIN_PASSWORD` in a shell startup file leaves a reusable account password in plaintext on disk. Such files are commonly included in workstation backups, support bundles, dotfile repositories, and accidental disclosures. Exporting it globally also makes the secret av ...[truncated 1078 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/garmin_activity_files.py:31
Finding: Sensitive Activity Files Are Written to Predictable Shared Temporary Paths
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: scripts/frisbee_chart.py:837
Finding: Generated Health Dashboards Execute Remotely Hosted JavaScript Without Integrity Verification
Content: View full analysis
``` The general health dashboard uses the same pattern: ```html ``` ### Technical Analysis Each generated dashboard retrieves and executes JavaScript from jsDelivr when opened. Although package versions are specified in the URL, the files are not protected by Subresource Integrity hashes. The effective executable dashboard payload therefore depends on remote CDN content that is outside the audited project. The external script executes in a page containing sensitive health and activity data. It can read the document, inspect embedded chart payloads, alter the displayed analysis, and initiate network communication. This external JavaScript is needed only for chart rendering, not for Garmin authentication or data retrieval. Bundling a reviewed local copy would provide the same declared functionality without runtime remote-code dependency. ### Attack Path 1. The npm package, package-owner account, CDN infrastructure, DNS path, or delivery process is compromised. 2. Modified JavaScript is served at one of the referenced URLs. 3. The user opens a generated Garmin dashboard while connected to the network. 4. The browser downloads and executes the modified code in the dashboard. 5. The code reads embedded heart-rate, HRV, sleep, Body Battery, activity, or tournament information. 6. It manipulates the analysis or attempts to transmit the info ...[truncated 407 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
**Session tokens** - Stored in `~/.clawdbot/garmin/` with directory permissions `700` (owner read/write/execute only) - Managed by the `garth` library (part of `garminconnect`); format is an opaque token bundle, not plaintext password - To revoke: `rm -rf ~/.clawdbot/garmin/` — next login will re-authenticate **Network** - Credentials are used only to authenticate with Garmin Connect and are not transmitted to any third-party service

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
**Session tokens** - Stored in `~/.clawdbot/garmin/` with directory permissions `700` (owner read/write/execute only) - Managed by the `garth` library (part of `garminconnect`); format is an opaque token bundle, not plaintext password - To revoke: `rm -rf ~/.clawdbot/garmin/` — next login will re-authenticate **Network** - Credentials are used only to authenticate with Garmin Connect and are not transmitted to any third-party service

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
**Session tokens** - Stored in `~/.clawdbot/garmin/` with directory permissions `700` (owner read/write/execute only) - Managed by the `garth` library (part of `garminconnect`); format is an opaque token bundle, not plaintext password - To revoke: `rm -rf ~/.clawdbot/garmin/` — next login will re-authenticate **Network** - Credentials are used only to authenticate with Garmin Connect and are not transmitted to any third-party service

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The documentation tells users to copy .env.example to .env and place credentials there, which normalizes storing secrets in a local plaintext environment file without any accompanying protections or caveats. While common in development workflows, this can expose credentials through accidental source control commits, backups, shared machines, or weak filesystem hygiene.
Content: Scanner excerpt · references/mcp_setup.md (reported line 28)May include surrounding context.
md
# Install and setup npm install pip3 install garminconnect fitparse gpxpy cp .env.example .env # Edit .env with your credentials # Authenticate

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: The instruction to edit the .env file with credentials reinforces direct placement of secrets into a local file, again without warning about exposure risks or secure alternatives. In context, this is a legitimate installation guide, but the absence of security guidance makes credential mishandling more likely.
Content: Scanner excerpt · references/mcp_setup.md (reported line 29)May include surrounding context.
md
npm install pip3 install garminconnect fitparse gpxpy cp .env.example .env # Edit .env with your credentials # Authenticate npm run auth

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document provides concrete instructions for saving and restoring OAuth tokens and logging in with email/password, but it does not warn that these credentials and tokens are sensitive secrets that must be stored securely and never hardcoded, logged, or shared. In a skill/reference context, users may copy these examples directly into insecure scripts or agent memory, increasing the risk of account compromise and unauthorized access to health and activity data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This documentation encourages collection and analysis of highly sensitive health and location-derived activity data, including heart rate, HRV, sleep, GPS, and tournament timelines, without any privacy notice, consent guidance, retention guidance, or warning about downstream exposure. In an agent skill context, normalizing these operations without safeguards increases the risk that users or downstream tools will export, share, or persist sensitive biometric data in ways they do not fully understand.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The examples explicitly write HTML dashboards containing activity and health analytics to ~/Desktop without warning that sensitive data will be stored in a local file. That can expose private information to other local users, backups, sync services, screenshots, or accidental sharing, especially because the dashboards may include identifiable fitness, recovery, and timeline data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The setup instructions direct users to create a .env file with credentials and run an authentication flow, but they do not include any warning about safeguarding secrets, avoiding accidental commits, or the risks of local token storage. In a setup guide for a tool that handles account authentication, omission of basic credential-handling guidance can lead to credential exposure or insecure storage practices by users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code makes API calls to retrieve sensitive biometric and activity information, including HRV and heart rate, which are privacy-relevant data types. While the script logs progress, it does not disclose to the user that it will access and analyze health data, and the module docstring/CLI help also omit that warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes a detailed HTML report containing personal fitness and health metrics to disk and automatically opens it in a browser, but does not clearly warn the user that a persistent local artifact is being created. On shared systems or synced home directories, this can unintentionally expose sensitive data to other local users, backup systems, cloud sync providers, or browser history/recent-files mechanisms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This script aggregates multiple categories of sensitive health data (sleep, HRV, body battery, intraday heart rate) and outputs them as JSON or an HTML dashboard without any explicit privacy warning, consent confirmation, or output protection. In the context of a tournament report, this creates a real risk of unintentionally exposing detailed personal health information through saved files, browser display, or later sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script explicitly supports passing the Garmin password via a --password command-line argument, which can expose secrets through shell history, process listings, audit logs, and job runners. In this context, the script is an authentication helper that handles real account credentials and stores session tokens, so encouraging CLI password entry materially increases the risk of credential disclosure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring states that the script fetches health data, but the implementation also exposes profile PII via the profile metric, including name and email. This mismatch can mislead users or downstream agents about the scope of collected data, increasing the risk of unintended disclosure of sensitive personal information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script retrieves sensitive health telemetry and profile information, then prints it directly to stdout as formatted JSON. In agent or tool-execution environments, stdout is commonly logged, captured, or forwarded to other components, so this creates a straightforward privacy exposure path for health data and PII without any warning, consent check, or output minimization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This script retrieves highly sensitive health and biometric data from a Garmin account and prints it directly to stdout without any privacy notice, consent check, masking, or output minimization. In agent or automation contexts, stdout is often captured by logs, pipelines, chat transcripts, or other downstream systems, which can unintentionally expose protected personal health information.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with only a lower bound, which allows future unreviewed versions to be installed. This weakens build reproducibility and can expose the skill to supply-chain risk or accidental adoption of a vulnerable or breaking release.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
garminconnect>=0.2.19 fitparse>=3.2.0 gpxpy>=1.3.5

Unverifiable Dependency: garminconnect has 2 known advisory(ies) (CVE-2026-54447 (garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store); CVE-2026-54447 (garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: The manifest references garminconnect without pinning a version even though advisories exist for that package, so there is no way to verify whether deployment will install an affected release. Given the cited issue involves insecure permission assignment for an OAuth token store, exploitation could expose or improperly permit access to authentication tokens if a vulnerable version is resolved.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is not pinned to an exact version, so installations may resolve to different releases over time. That increases supply-chain exposure and makes it harder to verify which code is actually running.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
garminconnect>=0.2.19 fitparse>=3.2.0 gpxpy>=1.3.5

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Using an unpinned package version permits uncontrolled upgrades during installation. In practice this can introduce vulnerable, malicious, or incompatible upstream releases without any change to this repository.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
garminconnect>=0.2.19 fitparse>=3.2.0 gpxpy>=1.3.5

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

🥏 {name}

T08 · Insecure Dependencies

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T03 · Remote Payload Retrieval and Execution

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Credential Access

Credential Access

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Static analysis