Security audit

Garmin Connect

Security checks across malware telemetry and agentic risk

Overview

This Garmin skill appears purpose-aligned, but it needs review because it asks for Garmin credentials on the command line and continuously stores sensitive fitness data with limited safeguards.

Review before installing. Use only on a trusted single-user machine, avoid putting your Garmin password directly in a shell command, protect ~/.garth/session.json and Garmin cache files as sensitive data, adjust or remove /tmp logging/cache paths, and enable the five-minute cron job only if continuous health-data collection is intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documents file read/write behavior and fixed cache/session paths but does not declare corresponding permissions. Undeclared storage access reduces transparency and prevents users or platforms from making informed trust decisions, especially because the stored data includes sensitive health and authentication session material.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior conflicts with the stated OAuth-based design by instructing users to pass their Garmin email and password directly on the command line and by persisting session state on disk. This mismatch is dangerous because users may trust the safer description while exposing credentials in shell history, process listings, logs, or insecure local storage.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The README claims OAuth authentication but instructs users to supply their Garmin email and password directly on the command line to an auth script. This exposes credentials through shell history, process listings, logs, and automation tooling, and it also misrepresents the flow as OAuth when it appears to require primary account credentials.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script embeds and displays a specific personal email address in login instructions, unnecessarily disclosing personally identifiable information. In a distributed skill, this leaks the maintainer or user's identity and can facilitate phishing, account enumeration, or targeted social engineering against the Garmin account.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script requires a raw email and password to be passed on the command line, which exposes credentials via shell history, process listings, audit logs, and monitoring tools on the host. This is especially risky because the skill is described as OAuth-based sync, yet it introduces unnecessary direct credential handling that can compromise the Garmin account and any linked fitness data.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The module claims to perform OAuth authentication setup, but the implementation actually performs direct username/password login and persists a session dump to disk. This mismatch can mislead users and reviewers into trusting a safer authentication model than is actually used, increasing the chance that sensitive credentials and session material are handled without appropriate safeguards.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill encourages continuous syncing of sensitive health and fitness data, including heart rate, sleep, and workouts, but does not clearly warn users about the privacy implications of ongoing transmission and local caching. In this context, the data is inherently sensitive, so omission of consent and storage warnings increases the risk of unintended exposure or misuse.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The cron setup instructs users to run unattended background synchronization every 5 minutes without clearly warning that collection will continue automatically and persist sensitive fitness data over time. Because this is a health-data integration, unattended operation materially increases the chance of unnoticed overcollection, excessive retention, and exposure through local files or dependent systems.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill handles highly sensitive health and fitness information but does not clearly warn users about the privacy implications of collecting, caching, and exposing this data to other local tools. In this context, omission of such warnings increases the chance of uninformed consent and accidental disclosure of personal health patterns.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The instructions tell users to enter their Garmin email and password as command-line arguments without warning that such credentials may be exposed through shell history, terminal scrollback, process lists, audit logs, or automation tooling. For an account tied to personal health data, this creates a significant credential exposure risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The cron setup encourages continuous collection and local caching of sensitive personal data every five minutes without clearly warning users about persistent monitoring and accumulation. In a health-data context, frequent automated collection increases privacy impact if the host is shared, compromised, or backed up to less secure destinations.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Passing the password as a positional CLI argument exposes it to local disclosure through process inspection tools, shell history, job control logs, and crash/telemetry capture. In the context of a background sync skill handling personal fitness and health-adjacent data, compromise of these credentials could allow persistent unauthorized access to the user's Garmin account and stored session.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script writes sensitive health and fitness data, including heart rate, sleep, and workout details, to a local cache file and allows the location to be overridden, with a default under /tmp. On multi-user systems or insecure environments, this can expose private data through weak file permissions, temporary-file access, or unintended persistence beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This script collects highly sensitive health data (sleep, heart rate, workouts, calories) and writes it to a local cache file and stdout without any explicit consent flow, privacy notice, masking, or output restrictions. In an agent/skill context, stdout and cache files may be ingested by other components, logs, or users unexpectedly, increasing the chance of privacy leakage even if no direct exfiltration code is present.

Unpinned Dependencies

Low

Category: Supply Chain
Content: garminconnect>=0.3.2 requests>=2.28.0 python-dateutil>=2.8.2
Confidence: 91% confidence
Finding: garminconnect>=0.3.2

Unpinned Dependencies

Low

Category: Supply Chain
Content: garminconnect>=0.3.2 requests>=2.28.0 python-dateutil>=2.8.2
Confidence: 98% confidence
Finding: requests>=2.28.0

Unpinned Dependencies

Low

Category: Supply Chain
Content: garminconnect>=0.3.2 requests>=2.28.0 python-dateutil>=2.8.2
Confidence: 90% confidence
Finding: python-dateutil>=2.8.2

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High

Category: Supply Chain
Confidence: 99% confidence
Finding: requests==2.28.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.