Garmin Sync Cn To Global

Sync activities from Garmin China to Garmin Global using local timestamps and distance to avoid duplicates in a one-way sync process.

Security Scan

The code and runtime instructions match the stated purpose (one-way sync from Garmin China to Garmin Global); the main risks are plaintext credential storage and minor packaging/installation assumptions, but overall the skill is internally consistent with its description.

Purpose & Capability

The name/description (sync CN → Global) aligns with the code and runtime instructions: the script logs into garmin.cn and garmin.com, downloads activity archives from CN and uploads to Global using timestamps+distance to detect duplicates. Minor mismatch: SKILL.md shows a 'garmin-sync' CLI (garmin-sync sync / set-credentials) but the bundle only includes sync.py and no install/entrypoint; that means the documented command may not exist until the user installs/wraps the script.

Instruction Scope

SKILL.md instructions are scoped to installing the 'garth' dependency, storing credentials, and running the sync. The script reads/writes only under ~/.config/garmin-sync and /tmp and calls Garmin APIs; it does not access unrelated system paths. Security-relevant behavior is explicit: credentials are stored in plaintext and the README notes this and recommends chmod 600 and using a sandbox account.

Install Mechanism

There is no install spec in the bundle (instruction-only), so nothing is written to disk by an installer. The code file is included but not packaged as a CLI; the SKILL.md assumes a 'garmin-sync' command while the repo only provides sync.py. Dependency installation is limited to 'pip install garth' (a public PyPI package) — no downloads from unknown URLs or archive extraction are present.

Credentials

The skill requests no environment variables or unrelated credentials. It requires your Garmin email/password(s), which is proportionate to logging into Garmin accounts to perform the sync. The main concern is storing those passwords in plaintext under ~/.config/garmin-sync/credentials.json (the code sets file mode 600 when saving via save_credentials).

Persistence & Privilege

The skill does not request 'always' privilege and will not run autonomously by default. It writes its own state and failed-record files under ~/.config/garmin-sync and temporary zips to /tmp (deleted after use), which is appropriate for its purpose and within expected scope.

Assessment

This skill appears to do exactly what it says: log into Garmin CN and Garmin Global, download .fit files from CN and upload them to Global, tracking state and failed records. Before installing/running: 1) Review the code yourself (or run it in a sandbox/VM) because it requires your Garmin email/password and stores them on disk. 2) Prefer using a dedicated/test Garmin account rather than your primary account. 3) If you use set-credentials, the script saves credentials in plaintext at ~/.config/garmin-sync/credentials.json but save_credentials sets mode 600; still treat the file as sensitive. 4) The SKILL.md shows a 'garmin-sync' CLI but the bundle only contains sync.py — you may need to run it directly (python sync.py ...) or create an entrypoint wrapper. 5) Verify the 'garth' package you install is the correct/official package; inspect its code or pin a known-good version. If you need help verifying the package or running the tool in an isolated environment, consider doing that before supplying real credentials.

Sync activities from Garmin China (garmin.cn) to Garmin Global/International (garmin.com).

Usage

# Install dependencies
pip install garth

# Set credentials (once, stored in ~/.config/garmin-sync/credentials.json)
garmin-sync set-credentials --email your_email --password your_password

# Sync new activities from CN to Global
garmin-sync sync --new-only

Options

• --new-only - Only sync records newer than last sync time (recommended for cron jobs)

Behavior

• Silent when no new activities: If there are no activities to sync (and no failed retries), the script exits silently with no output. This is useful for cron jobs where you only want to be notified when there's actual work to do.
• English output: All output is in English for consistency.

Requirements

• Python 3.x
• garth library (pip install garth)

Notes

• One-way sync: CN → Global (not bidirectional)
• Uses startTimeLocal + distance to detect duplicates (activity IDs differ between servers)
• Skips conflicts automatically
• Same email/password works for both Garmin CN and Garmin Global accounts

Security Considerations

• Credentials are stored in plaintext at ~/.config/garmin-sync/credentials.json
• Set restrictive file permissions after first run: chmod 600 ~/.config/garmin-sync/credentials.json
• Consider using a dedicated/sandbox account for testing
• Review the code before running with your primary credentials