Garmin Connect Data Query

读取 Garmin Connect 手表/设备数据。 触发场景： - "今天走了多少步" - "昨晚睡眠怎么样" - "最近有什么运动" - "心率怎么样" - "这周跑了多少次" - 查询任意日期的运动、睡眠、心率等健康数据

Security Scan

The skill's code, instructions, and requirements align with its stated purpose (reading Garmin Connect data using a browser-extracted JWT); no unexplained network endpoints, extra credentials, or installation downloads were found.

Purpose & Capability

Name/description match the included code and docs. The scripts call Garmin Connect endpoints and require a JWT from the user's Garmin session cookie — this is coherent for a client that reads personal Garmin data.

Instruction Scope

SKILL.md and references explicitly instruct the user to extract the JWT_WEB cookie from the browser and pass it to the Python scripts. That is necessary for the described functionality, but it involves handling a sensitive bearer token; the docs warn about token secrecy. No instructions ask the agent to read unrelated files or exfiltrate data to other endpoints.

Install Mechanism

This is instruction-only (no install spec). The project includes small Python scripts and the README advises installing the 'requests' package via pip. No downloads from arbitrary URLs or archive extraction steps are present.

Credentials

The only sensitive credential the skill needs is the Garmin JWT token (user-provided). The metadata declares no required env vars, though README suggests an optional GARMIN_JWT env var. No unrelated credentials or secrets are requested. Minor oddity: scripts use a hard-coded default userId ('116181268') when none is provided, which is unnecessary and could be confusing.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system-wide configuration, and does not persist credentials. It only runs the included scripts when invoked.

Assessment

This skill appears internally consistent and implements exactly what it says: it queries Garmin Connect APIs using a browser-extracted JWT. Before installing/running it, remember: (1) the JWT is a sensitive bearer token — treat it like a password and do not share it; (2) follow the README steps locally and inspect the included scripts yourself before running; (3) the scripts print data to stdout only, but if you store the token in an environment variable or a file, be careful not to commit or share it; (4) the scripts include a hard-coded default userId from the author — you can ignore that and let the code fetch your userId via the API. If you are uncomfortable extracting tokens from your browser, do not use the skill.

Garmin Connect 数据查询

前置要求

• JWT Token（从浏览器获取，有效期约1个月）
• Python 3.8+

快速查询

python3 scripts/query.py <jwt_token> [日期 YYYY-MM-DD]

不传日期默认查今天。

数据类型

查询	字段
步数	totalSteps
距离(km)	totalDistance / 1000
卡路里	activeKilocalories
爬楼层数	totalFloorsAscending
睡眠时长	sleepingDuration

API 端点

详见 references/api.md

Token 获取

1. 浏览器打开 https://connect.garmin.cn 并登录
2. F12 → Application → Cookies → connect.garmin.cn
3. 找到 JWT_WEB，复制 Value（eyJ... 开头）

注意

JWT 过期后需重新获取。每次查询前检查 Token 有效性。