Security audit
Security checks across malware telemetry and agentic risk
This Garmin health-data skill has useful, mostly purpose-related features, but it needs review because it weakly stores Garmin credentials and includes under-scoped Feishu/webhook sharing of sensitive health reports.
Install only after reviewing the Feishu/webhook scripts, daemon/timer behavior, and local storage paths. Avoid using the password-on-command-line examples, treat ~/.garth/session.json and ~/.clawdbot/garmin/data.db as highly sensitive, remove or rotate the embedded Feishu credentials, and disable outbound reports unless you explicitly want Garmin health summaries sent to that destination.
if not script_path.exists():
return f"❌ 脚本不存在：{script_path}"
result = os.popen(f'python3 {script_path}').read()
if not result:
return "❌ 暂无数据"}
try:
response = requests.post(url, headers=headers, json=data, timeout=10)
result = response.json()
if result.get("code") == 0:63/63 vendors flagged this skill as clean.
No suspicious patterns detected.