ClawHub
Back to skill

Security audit

garmin-pulse

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it syncs Garmin health data to local markdown files, with sensitive token and health-data storage disclosed.

Install only on a trusted machine/account because it stores long-lived Garmin tokens and detailed health data locally. Review permissions on ~/.garminconnect and the health output directory, avoid syncing those files to shared backups or repositories, and be aware that other Garmin tools using the same token cache may be able to reuse the session.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill performs network access, writes files, and uses environment-dependent paths, yet it declares no permissions. This creates a transparency and governance gap: users or policy engines cannot accurately assess that the skill contacts Garmin, stores tokens in ~/.garminconnect, and writes sensitive health data to disk before installation or execution.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The script collects and writes nutrition data even though the stated skill description does not disclose that capability. This is a scope-expansion/privacy issue because users may authorize or run the skill expecting only fitness and recovery metrics, while the code also extracts food-log information, which is sensitive health data.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The README documents writing sensitive health data to local markdown files and caching Garmin OAuth tokens for about a year, but it does not clearly foreground the privacy and security consequences of doing so. In an agent skill context, this can lead users to store highly sensitive biometric data and long-lived session material on shared or weakly protected systems without realizing the exposure or overwrite behavior.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script writes highly sensitive health information to local markdown files without an explicit privacy warning, consent checkpoint, or safeguards on destination selection. This can expose sleep, heart rate, SpO2, stress, weight, and other intimate data to other local users, backups, sync tools, or accidental sharing.

Session Persistence

Medium
Category
Rogue Agent
Content
## Related

- [garmin-nutrition](https://github.com/weirdei/garmin-nutrition) — the write side: add and delete food entries in the Garmin Connect log. This skill reads the day's nutrition totals; that one logs the food. Both share the same `~/.garminconnect/` tokens.

## Credits
Confidence
74% confidence
Finding
The README states that this skill shares the same persistent `~/.garminconnect/` tokens with another tool that can modify Garmin data. Shared session persistence across tools increases blast radius: compromise or misuse of one related tool can reuse the same tokens to access or change account data without re-authentication.

Static analysis

No suspicious patterns detected.