Garmin Skill

Talk to your Garmin data — ask questions about your activities, training load, VO2 Max, heart rate zones, and more using AI.

Security Scan

The skill's instructions require a Transition API key and will send your Garmin data to an external service, but the registry metadata does not declare the required credential and the provenance is unclear — proceed only after verifying the provider and updating metadata.

Purpose & Capability

The skill claims to let an agent query your Garmin data via Transition, which reasonably requires a TRANSITION_API_KEY. However, the registry metadata lists no required environment variables or primary credential. That mismatch (metadata says 'none' but SKILL.md instructs users to set TRANSITION_API_KEY) is an incoherence and makes it harder to audit or enforce least privilege.

Instruction Scope

SKILL.md only documents HTTP calls to https://api.transition.fun and a free WOD endpoint; it does not instruct reading local files or other system state. However, it does direct agents to use an API key that grants 'full context' on the user's Garmin activities — this means personal fitness data will be sent to an external service. The instructions are otherwise concrete and not open-ended, but the privacy/exfiltration risk (sending all Garmin data to transition.fun) should be considered.

Install Mechanism

There is no install spec and no code files beyond README and SKILL.md (instruction-only). That lowers installation risk: nothing is downloaded or written to disk by the skill itself. README suggests an optional git clone of a public repo, which is normal but not enforced by the registry.

Credentials

The runtime requires a TRANSITION_API_KEY (documented in SKILL.md and README) but the skill metadata does not declare any required environment variables or a primary credential. Requiring a single API key for the external service is proportionate to the feature set, but the metadata omission is a governance/privacy gap. Also note that the API key appears to grant access to all synced Garmin data, which is sensitive personal information.

Persistence & Privilege

The skill does not request always:true, does not include install scripts, and will not be force-enabled by the platform. It relies on an external API and an API key provided by the user; it does not request elevated platform privileges.

Scan Findings in Context

[no-code-files] expected: The scanner found no code files to analyze. SKILL.md is instruction-only, which is expected for simple API-binding skills. Lack of code reduces some attack surface but also means the metadata mismatch is the primary issue.

What to consider before installing

This skill asks you to generate a TRANSITION_API_KEY and will send your Garmin Connect data to https://api.transition.fun. Before installing: (1) Verify you trust Transition (read its privacy policy and confirm how long it stores/export access); (2) ask the skill publisher to update the registry metadata to declare TRANSITION_API_KEY as a required credential (metadata currently lists none); (3) treat the API key like a password — generate it in your Transition account, restrict or revoke it if you stop using the skill, and do not paste it into public places; (4) if you only want one-off workouts, use the unauthenticated WOD endpoint instead of granting full access; (5) if provenance matters, verify the skill's source repository and publisher identity (the registry owner ID and homepage are not authoritative on their own). If you cannot verify the provider or get corrected metadata, consider this suspicious and avoid installing.

Chat with your Garmin Connect data using AI. Ask about your runs, rides, swims, training load, VO2 Max, heart rate zones, and performance trends. Powered by Transition, which syncs with Garmin Connect to give AI agents access to your training data.

Setup

1. Download Transition and connect your Garmin account
2. Go to Settings > API Keys and tap Generate New Key
3. Set the environment variable:

export TRANSITION_API_KEY="tr_live_xxxxxxxxxxxxxxxxxxxxx"

No Auth Required

Workout of the Day

Generate a random structured workout — no account needed.

curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"

Parameters:

• sport — run, bike, swim, or strength (default: run)
• duration — minutes, 10-300 (default: 45)

Authenticated Endpoints

Base URL: https://api.transition.fun Auth: Pass X-API-Key header on every request.

AI Coach Chat

Ask questions about your Garmin data. The AI coach has full context on your activities, training load, and performance.

curl -X POST -H "X-API-Key: $TRANSITION_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message": "How has my running volume changed this month compared to last?"}' \
  "https://api.transition.fun/api/v1/coach/chat"

Example questions:

• "What was my longest run this week?"
• "How is my VO2 Max trending?"
• "Am I overtraining based on my recent Garmin data?"
• "Compare my cycling power this month vs last month"
• "What does my heart rate data say about my fitness?"

Get Workouts

Retrieve scheduled workouts for a date range.

curl -H "X-API-Key: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/workouts?start=2026-02-09&end=2026-02-15"

Parameters:

• start — Start date (YYYY-MM-DD, required)
• end — End date (YYYY-MM-DD, required)
• Maximum range between start and end is 90 days.

Performance Management Chart (PMC)

Get CTL (fitness), ATL (fatigue), and TSB (form) calculated from your Garmin activities.

curl -H "X-API-Key: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/performance/pmc"

Performance Stats

Get FTP, threshold paces, heart rate zones, and other metrics derived from your Garmin data.

curl -H "X-API-Key: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/performance/stats"

Athlete Profile

curl -H "X-API-Key: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/profile"

Chat History

curl -H "X-API-Key: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/coach/history"

Push Workout to Garmin

Send a scheduled workout directly to your Garmin device.

curl -X POST -H "X-API-Key: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/workouts/123/push-garmin"

Rate Limits

Tier	Read Endpoints	AI Endpoints
Free	100/day	3/day
Paid	10,000/day	100/day

Tips for Agents

1. Use coach chat as the primary interface. It has full context on the user's Garmin activities, training load, and performance — just ask natural questions.

2. Check fatigue before recommending hard workouts. Call GET /api/v1/performance/pmc and look at TSB. If TSB is below -20, the athlete is fatigued.

3. Use the free WOD endpoint for quick workouts. No auth needed — great for users who just want a workout suggestion.

4. Date format is always YYYY-MM-DD for all date parameters.