The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches OAuth consumer configuration from https://thegarth.s3.amazonaws.com/oauth_consumer.json. This resource is hosted on a well-known cloud service (Amazon S3) and is used to retrieve the public keys required to maintain compatibility with the Garmin mobile authentication flow.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes health, sleep, and activity data from Garmin Connect APIs, which represents a surface for indirect prompt injection.
Ingestion points: External data enters the agent context through several endpoints on connectapi.garmin.com as defined in the Api object within scripts/garmin.ts.
Boundary markers: The instructions in SKILL.md do not provide explicit delimiters or warnings to treat the retrieved health data as untrusted; instead, the agent is directed to parse the JSON output and respond conversationally.
Capability inventory: The skill has the ability to perform network requests and write to the local file system (specifically to manage token caching in ~/.config/garmin-api/).
Sanitization: The script uses standard JSON.parse() for API responses but does not implement additional sanitization of the data before it is presented to the agent.
[COMMAND_EXECUTION]: The skill's standard usage involves executing the scripts/garmin.ts utility using the bun runtime.
[DYNAMIC_EXECUTION]: The SKILL.md file contains a "Self-repair" protocol that instructs the agent to modify the source code of scripts/garmin.ts in response to service provider changes. This allows for runtime modification of authentication constants, user agents, and API paths.

garmin-connect