Security audit
Security checks for vulnerabilities and agentic risk
This Garmin skill is coherent and not malicious, but it sends sensitive fitness data to a third-party service and exposes a Garmin write action without enough privacy, credential, or confirmation guidance.
Review this before installing if you are comfortable giving Transition and an agent access to Garmin-derived activity, performance, profile, schedule, and chat data. Protect the API key like a password, avoid logging it, and require explicit confirmation before any push-to-Garmin action.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Try it right now — no API key needed:
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
For personalized features (your Garmin data, training plan, AI coach), you need a Transition account + API key. See Getting an API Key below.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Try it right now — no API key needed:
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
For personalized features (your Garmin data, training plan, AI coach), you need a Transition account + API key. See Getting an API Key below.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Try it right now — no API key needed:
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
For personalized features (your Garmin data, training plan, AI coach), you need a Transition account + API key. See Getting an API Key below.
The README explicitly encourages users to send personalized Garmin data, training information, and AI coach queries to a third-party remote API, but it does not provide an explicit privacy notice, data handling explanation, or warning about what sensitive health/fitness data leaves the local environment. Because Garmin-derived metrics can reveal health, location, habits, and performance trends, the omission creates a real privacy/security risk through uninformed data disclosure.
The README instructs users to send authenticated requests containing personalized Garmin-derived data and natural-language health/performance questions to a remote API using an API key. While this is likely the intended product behavior rather than malicious exfiltration, it is still a genuine security/privacy concern because sensitive personal fitness and health-adjacent data is transmitted off-platform without nearby disclosure of privacy implications, retention, or secondary use.
curl -X POST -H "X-API-Key: $TRANSITION_API_KEY" \
-H "Content-Type: application/json" \
-d '{"message": "How has my running volume changed this month compared to last?"}' \
"https://api.transition.fun/api/v1/coach/chat"
# Get your fitness/fatigue/form metrics
curl -H "X-API-Key: $TRANSITION_API_KEY" \
This example sends authenticated requests for fitness/fatigue/form metrics to a third-party API, which implies transmission of personal performance data outside the user's local environment. In a Garmin skill, that context makes the transmission more sensitive because the data may expose health status, training load, and behavioral patterns, so the absence of explicit warning and handling details makes this a real privacy vulnerability.
curl -H "X-API-Key: $TRANSITION_API_KEY"
"https://api.transition.fun/api/v1/performance/pmc"
---
The skill explicitly encourages sending Garmin activity, training, and health-adjacent data to a third-party AI service, but it does not disclose privacy, retention, or sharing implications. Because this data can reveal sensitive fitness and health patterns, the omission meaningfully reduces informed user consent and increases privacy risk.
The documentation instructs users to generate and export a live API key but provides no warning about protecting the credential from shell history, logs, screenshots, shared terminals, or repository commits. Exposure of this key could let others query private Garmin-derived data or perform actions against the user's account.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate a random structured workout — no account needed.
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
Parameters:
This endpoint sends user prompts and the service is described as having full context on Garmin activities, training load, and performance, meaning sensitive personal fitness data is transmitted to and processed by an external AI service. The risk is amplified by the absence of nearby privacy, retention, and consent warnings.
curl -X POST -H "X-API-Key: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "How has my running volume changed this month compared to last?"}'
"https://api.transition.fun/api/v1/coach/chat"
Example questions:
This authenticated request retrieves scheduled workouts from a third-party service using a bearer-style API key, so it involves transmission of account-linked training data to an external provider. The behavior is expected for the skill, but it still presents a real privacy risk if users are not clearly informed about the external data flow and credential sensitivity.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/workouts?start=2026-02-09&end=2026-02-15"
Parameters:
The PMC endpoint exposes derived fitness/fatigue/form metrics tied to the user's Garmin activity history through an external service. While this is core functionality, these metrics are still sensitive personal performance data and should not be transmitted without clear user awareness and privacy guidance.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/performance/pmc"
This endpoint retrieves threshold paces, heart rate zones, FTP, and similar performance metrics from an external service, which are sensitive fitness and health-adjacent data points. In the absence of explicit privacy/security warnings, the documentation understates the sensitivity of the transmission.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/performance/stats"
The athlete profile endpoint likely returns personally identifiable and account-linked profile information from an external service. Because the skill omits a clear warning about sharing personal profile data with a third party, this is a legitimate privacy concern rather than a mere benign URL reference.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/profile"
Chat history may contain highly sensitive free-text discussions about health, performance, goals, and past activities, and this endpoint retrieves that content from a third-party AI service. Without warning users that conversational history is stored and accessible externally, the documentation creates a meaningful confidentiality risk.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/coach/history"
The documented push-to-Garmin endpoint performs a state-changing action on the user's Garmin ecosystem, but the skill does not clearly warn that it will modify scheduled workouts or sync content to a device. Without an explicit confirmation step, an agent or user could trigger unintended changes to training plans or device state.
This external POST performs a write action that pushes a workout toward the user's Garmin environment, creating both external transmission and state-change risk. In this skill context, the danger is higher because an agent could modify training state on behalf of the user without an explicit warning or confirmation flow.
curl -X POST -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/workouts/123/push-garmin"
No suspicious patterns detected.