garmin-pulse-hardened
Fail
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: HIGHDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses the sensitive local directory
~/.garminconnect/to store and retrieve OAuth tokens, which represents exposure of sensitive authentication material. - [COMMAND_EXECUTION]: The skill explicitly guides the agent to use the
crontool to schedule the sync script for automated execution, which functions as a persistence mechanism. - [PROMPT_INJECTION]: Includes a "Security Guardrails" section containing behavioral instructions (e.g., "Never reference, read, or check ~/.garminconnect/") and a "Safety Evaluation" metadata file that attempt to override agent processing logic and make authoritative claims about the skill's own security.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
uvpackage manager to dynamically install Python dependenciesgarminconnectandcloudscraperfrom public registries during script execution. - [PROMPT_INJECTION]: The skill ingests external data from Garmin into markdown files within the
health/directory; this data is subsequently read by the agent without defined boundary markers or sanitization, creating a surface for indirect prompt injection.
Recommendations
- AI detected serious security threats
Audit Metadata