Garmin Health Analysis
v1.2.2Talk to your Garmin data naturally - "what was my fastest speed snowboarding?", "how did I sleep last night?", "what was my heart rate at 3pm?". Access 20+ metrics (sleep stages, Body Battery, HRV, VO2 max, training readiness, body composition, SPO2), download FIT/GPX files for route analysis, query elevation/pace at any point, and generate interactive health dashboards. From casual "show me this week's workouts" to deep "analyze my recovery vs training load".
⭐ 11· 4.4k·12 current·12 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match what the files implement: fetching Garmin Connect metrics, downloading FIT/GPX, parsing with fitparse/gpxpy, and generating charts. Requested env vars (GARMIN_EMAIL, GARMIN_PASSWORD) and Python deps (garminconnect, fitparse, gpxpy) are expected for this functionality. No unrelated credentials or binaries are required.
Instruction Scope
SKILL.md and scripts limit actions to authenticating to Garmin, reading account data, downloading activity files, and creating local charts/files. The login flow stores tokens under ~/.clawdbot/garmin (or similar) and the scripts write downloads to /tmp or skill dirs. Caveats: the skill uses an unofficial reverse-engineered library (garminconnect) and requires the user’s email/password (or local config) for authentication; instructions encourage saving credentials locally (config.json or Clawdbot config). These behaviors are functional but increase sensitivity/risk and may violate Garmin Terms of Service.
Install Mechanism
No opaque remote downloads; installation uses pip to install known Python packages (garminconnect, fitparse, gpxpy). install.sh is provided and only wraps pip installs and creates a config.json if missing. Using PyPI packages is moderate-risk but appropriate for the stated purpose.
Credentials
Only GARMIN_EMAIL and GARMIN_PASSWORD are required which matches the unofficial API's need for email/password login. However these are highly sensitive; the skill stores session tokens locally and may share them with an MCP server if used. Two-factor authentication is not supported by the library, and the README warns about rate limits and ToS issues. Requesting the raw account password is proportionate to the approach chosen (unofficial library) but is higher-risk than an OAuth/token-only flow.
Persistence & Privilege
The skill does persist session tokens locally (~/.clawdbot/garmin) and creates config.json in the skill folder; it does not request always:true or attempt to change other skills or system settings. Tokens are chmod'd to be restrictive in the provided script. This is normal for a credentialed integration and scoped to the user's home directory.
Assessment
This skill appears to do what it claims (download and analyze Garmin data) and requires your Garmin account email and password because it uses the unofficial 'garminconnect' library. Before installing: 1) Understand you are giving the skill highly sensitive credentials — prefer using environment variables or a dedicated local config file and ensure config.json is not committed to source control. 2) Review the garminconnect library and this repo's code yourself (authentication, token storage, and any network calls). 3) Be aware using an unofficial API can violate Garmin's Terms of Service and may break if Garmin changes their site; two-factor auth may not be supported. 4) Consider using the vendor's official Garmin Health API (enterprise) or the separate MCP server referenced by the author if you want a different auth model. 5) If you install, monitor for excessive requests (rate limits) and confirm tokens are stored securely (permissions) and not shared to third-party services you don't control.Like a lobster shell, security has layers — review code before you run it.
latestvk97crstrqbp9gq9nc1zn2a6n9s7zy316
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⌚ Clawdis
EnvGARMIN_EMAIL, GARMIN_PASSWORD