Security audit

Garmin Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a Garmin CLI reference, but it exposes sensitive account login, health data, write operations, and raw API calls with weak scoping and warnings.

Review this carefully before installing. Use a trusted and verified source for the gc CLI, avoid entering passwords or MFA codes directly in shell commands or agent prompts, and require explicit confirmation before any upload, workout create/update/delete, raw POST, or broad API call. Treat exported Garmin data as sensitive personal information.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unverified and Unpinned Third-Party Homebrew Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:18
Finding: Garmin Password and MFA Code Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest and description present this as a read-oriented data access skill, but the documented commands also allow mutation of user resources, including workout create/update/delete and activity upload. This creates a capability mismatch that can mislead users or downstream agents into granting broader trust than warranted, increasing the risk of unauthorized modification or destruction of Garmin data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is framed as access to health, fitness, and activity data, but the raw gc api interface exposes arbitrary Garmin endpoints and even POST requests. That broader undocumented control surface can enable actions far beyond passive retrieval, including state changes against endpoints not reviewed or anticipated by users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The authentication examples place email, password, and MFA values directly on the command line, which can leak secrets through shell history, process listings, terminal logs, or agent transcripts. In a skill intended for non-interactive CLI use, this materially increases the risk of credential exposure and account compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation advertises file output and later includes upload, delete, and raw POST functionality without explicit safety warnings or confirmation expectations. In an agent context, this can normalize potentially destructive or privacy-sensitive operations and make accidental modification, exfiltration, or overwriting of local and remote data more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Arbitrary raw API invocation is broader than the stated purpose and bypasses the narrower command abstractions that would normally limit misuse. Even if intended for advanced users, exposing unrestricted endpoint paths increases the chance of accidental or deliberate access to unrelated account functions or destructive operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.