Is garmin-health-analysis safe?
https://clawhub.ai/eversonl/garmin-health-analysis
This Garmin health analysis skill is a legitimate health data integration tool with no evidence of malicious intent. However, it presents moderate risk through plaintext credential storage across multiple filesystem locations, execution of five Python scripts with full shell access, and dependency on an unofficial community-maintained API library. The primary concern is that stored credentials and session tokens are accessible to other skills or processes on the same system.
Category Scores
Findings (9)
HIGH Plaintext credential storage in multiple locations -30 ▶
The skill instructs users to store Garmin email and password in plaintext across up to 4 locations: ~/.clawdbot/clawdbot.json, config.json in the skill directory, environment variables, and command-line arguments (visible in process lists). Any other skill or agent with filesystem read access can harvest these credentials. The credentials grant full access to the user's Garmin Connect account including location history, health data, and personal information.
HIGH Five executable Python scripts run via agent shell access -25 ▶
The skill instructs the LLM agent to execute garmin_data.py, garmin_query.py, garmin_chart.py, garmin_auth.py, and garmin_activity_files.py via python3 shell commands. These scripts use sys.path manipulation to import each other and execute with full user privileges. While current code appears benign, any modification to these scripts (via skill update) would be executed automatically by the agent without user review.
MEDIUM pip install of third-party packages with arbitrary setup code -15 ▶
The skill requires pip3 install of garminconnect, fitparse, and gpxpy. Python package installation can execute arbitrary code via setup.py. While these are legitimate, established packages, a supply chain compromise of any of them would result in code execution during installation. The garminconnect package is particularly sensitive as it is an unofficial, community-maintained library.
MEDIUM Token file readable by other processes -15 ▶
Session tokens stored at ~/.clawdbot/garmin-tokens.json persist OAuth tokens that grant API access to the user's Garmin account without needing the password. Other skills or processes on the same system could read this file to access Garmin data without the user's knowledge.
MEDIUM install.sh contents not available for review -10 ▶
The skill contains an install.sh file whose contents were not captured in the evidence collection. This shell script could contain arbitrary commands that execute during skill installation. Without visibility into its contents, it represents an unknown risk.
LOW Health analysis template could influence agent medical advice behavior -10 ▶
The references/health_analysis.md file contains detailed health interpretation frameworks with specific thresholds and recommendations. While it includes a medical disclaimer, the structured prompt template could cause the agent to provide authoritative-sounding health assessments that users might over-rely on. This is a design concern rather than a security issue.
LOW garmin_activity_files.py enables file downloads to arbitrary paths -15 ▶
The activity files script can download FIT/GPX/TCX files to the local filesystem. While intended for activity analysis, the download-and-parse pattern could be leveraged if the Garmin API response were manipulated to deliver malicious content. The fitparse library processes binary FIT files which could theoretically contain crafted payloads targeting parser vulnerabilities.
INFO Profile endpoint exposes user email 0 ▶
The garmin_data.py profile command returns the user's display name and email address. While this is the user's own data, it could be inadvertently logged or exposed in agent conversation history.
INFO Filesystem monitoring shows standard system reads only 0 ▶
All filesystem events during installation are attributable to standard system library loading (ld.so.cache), process initialization (nsswitch.conf, passwd, group), and the monitoring framework itself. No anomalous file access patterns detected.