Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real Garmin health-sync skill, but it stores sensitive credentials and health reports in risky ways and can send health data to Feishu/webhooks.
Review before installing. Use only on a trusted machine, avoid entering Garmin passwords on the command line, protect or delete ~/.garth/session.json and ~/.clawdbot health data when no longer needed, do not use the embedded Feishu credentials, and enable Feishu/webhook/timer features only after confirming exactly what health data will be sent and where.
if not script_path.exists():
return f"❌ 脚本不存在：{script_path}"
result = os.popen(f'python3 {script_path}').read()
if not result:
return "❌ 暂无数据"garminconnect>=0.2.38 requests>=2.28.0 python-dateutil>=2.8.2 garth>=0.5.0
garminconnect>=0.2.38 requests>=2.28.0 python-dateutil>=2.8.2 garth>=0.5.0
garminconnect>=0.2.38 requests>=2.28.0 python-dateutil>=2.8.2 garth>=0.5.0
garminconnect>=0.2.38 requests>=2.28.0 python-dateutil>=2.8.2 garth>=0.5.0
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.