Garminskill

• Analyzed: May 14, 2026, 3:39 AM
• Findings: 1
• Version: 1.3.1
• Hash: e7c93f19fa2093b3e57372132c1e31190522abb4d4d46d507b509136ee81dbc1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill 'garmin-pulse' is designed to sync health data from Garmin Connect to local markdown files. The `SKILL.md` provides clear instructions for the AI agent, including secure password handling via `getpass` during setup and explicit guidance on where to store and retrieve data. The `scripts/sync_garmin.py` script uses legitimate libraries (`garminconnect`, `cloudscraper`) to interact with Garmin's API and writes all fetched data to local files within the skill's directory or the user's home directory (`~/.garminconnect/` for tokens). There is no evidence of data exfiltration to unauthorized external endpoints, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior.