health

SUSPICIOUS: the skill’s health-data purpose is coherent with its storage, sync, and projection capabilities, and there is no clear malicious exfiltration path in the manifest. However, install trust is only partially verifiable, the package provenance is unclear from public evidence, and the optional garmin-connect-cli backend delegates credentials/tokens to an unrelated third-party tool, which is high-impact given the sensitivity of health and auth data.