← Back to Skills Marketplace
freakyflow

Garminskill

by freakyflow · GitHub ↗ · v1.3.1
cross-platform ✓ Security Clean
1682
Downloads
3
Stars
3
Active Installs
8
Versions
Install in OpenClaw
/install garmin-pulse
Description
Syncs daily health and fitness data from Garmin Connect into markdown files. Provides sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data.
README (SKILL.md)

Garmin Connect

This skill syncs your daily health data from Garmin Connect into readable markdown files.

Setup

Authentication is required before the first sync. This only needs to happen once — tokens are cached for approximately one year.

If the sync command fails with "No cached tokens found", tell the user to run the setup command in their terminal:

uv run {baseDir}/scripts/sync_garmin.py --setup --email [email protected]

The password is prompted interactively via getpass — it is never echoed to screen, stored in shell history, or passed as a command argument. On success the user will see Success! Tokens cached in ~/.garminconnect. After that, all syncs use cached tokens only — no credentials are needed.

Do not ask the user for their password in chat and do not pass passwords as command-line arguments or via stdin piping, as these methods can expose credentials in process listings or conversation history.

Syncing Data

Sync today's data:

uv run {baseDir}/scripts/sync_garmin.py

Sync a specific date:

uv run {baseDir}/scripts/sync_garmin.py --date 2026-02-07

Sync the last N days:

uv run {baseDir}/scripts/sync_garmin.py --days 7

Reading Health Data

Health files are stored at {baseDir}/health/YYYY-MM-DD.md — one file per day.

To answer health or fitness questions, read the relevant date's file from the {baseDir}/health/ directory. If the file doesn't exist for the requested date, run the sync command for that date first.

Dependencies

This skill uses uv to run the sync script. uv is a fast Python package manager by Astral that reads inline script metadata (PEP 723) and automatically installs dependencies (garminconnect, cloudscraper) in an isolated environment — no manual pip install needed.

Credentials & Stored Data

Garmin Connect does not offer a public OAuth API, so a one-time email/password login is required. During setup, the password is used once to obtain OAuth tokens, then discarded. The tokens are cached locally in ~/.garminconnect/ for approximately one year. At runtime, only the cached tokens are used — no email or password is needed. If tokens expire, re-run the setup command.

Paths written by this skill:

  • ~/.garminconnect/ — cached OAuth tokens (sensitive; grants access to the user's Garmin account)
  • {baseDir}/health/ — daily health markdown files (contains personal health data)

Cron Setup

Schedule the sync script to run every morning using OpenClaw's cron tool so your health data stays up to date automatically. No environment variables or credentials are needed — the sync uses cached tokens from the one-time setup.

Usage Guidance
What to consider before installing: - Account security: The script requires a one-time email/password login and caches OAuth tokens in ~/.garminconnect. Those tokens grant access to your Garmin account — protect the directory (file permissions) and avoid backing it up to untrusted cloud storage. - 2FA recommendation: The README says the garminconnect library does not support 2FA and instructs disabling two-step verification to use the skill. Disabling 2FA weakens your account security; weigh this tradeoff and consider using a separate Garmin account if you want to maintain MFA on your main account. - Dependency trust: The skill relies on the garminconnect and cloudscraper Python libraries. cloudscraper is explicitly used to bypass Cloudflare protections; while necessary to access the Garmin SSO endpoints, it increases the network/automation complexity. Review those libraries and the script if you have concerns about network behavior. - Installation source: The registry uses Homebrew to install uv (preferred). The README also documents curl | sh installers for uv — avoid running installers from unknown hosts unless you trust them. Prefer package manager installs from trusted repositories. - Local setup only: Setup is interactive and runs locally (uv run ...). Do not paste passwords into chat or allow remote agents to perform setup. The skill has disable-model-invocation enabled, which prevents the model from autonomously running it. - Audit if needed: If you want extra assurance, review the included script (scripts/sync_garmin.py) yourself or run it in a constrained environment. Consider creating a secondary Garmin account for testing if you don't want to alter your main account's security settings. Overall: the skill appears to do what it claims and is proportionate to its purpose, but be mindful of the explicit advice to disable 2FA and of the sensitive cached tokens it stores locally.
Capability Analysis
Type: OpenClaw Skill Name: garmin-pulse Version: 1.3.1 The OpenClaw skill 'garmin-pulse' is designed to sync health data from Garmin Connect to local markdown files. The `SKILL.md` provides clear instructions for the AI agent, including secure password handling via `getpass` during setup and explicit guidance on where to store and retrieve data. The `scripts/sync_garmin.py` script uses legitimate libraries (`garminconnect`, `cloudscraper`) to interact with Garmin's API and writes all fetched data to local files within the skill's directory or the user's home directory (`~/.garminconnect/` for tokens). There is no evidence of data exfiltration to unauthorized external endpoints, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's intended behavior.
Capability Assessment
Purpose & Capability
Name/description, required binary (uv), and the bundled Python script all match: the skill logs into Garmin Connect (via garminconnect + cloudscraper) and writes markdown files under the skill's directory. Requested binaries and dependencies are proportional to syncing Garmin data.
Instruction Scope
Runtime instructions are narrowly scoped to setup (interactive password prompt) and syncing data. They explicitly instruct the user to run a one-time setup in a terminal and warn not to paste passwords into chat. However, the README advises disabling Garmin two-factor authentication (2FA) because the underlying library doesn't support 2FA — this is a security tradeoff that users should consider. The script also uses cloudscraper to bypass Cloudflare, which is functionally necessary but worth knowing about.
Install Mechanism
Registry install metadata uses a Homebrew formula for uv (reasonable). The skill relies on uv to create an isolated environment and fetch Python deps (garminconnect, cloudscraper) per inline metadata. The README additionally documents curl | sh installers for uv (common but higher-risk), so users should prefer trusted package sources (Homebrew) and be aware uv will fetch packages from public PyPI at runtime.
Credentials
The skill requests no environment variables or external credentials in the registry metadata. It performs a one-time interactive login and caches OAuth tokens in ~/.garminconnect, which is expected for this purpose. Those cached tokens are sensitive (they grant access to the Garmin account) but their use is proportional to the stated function.
Persistence & Privilege
always is false and disable-model-invocation is true in the skill metadata, limiting autonomous invocation. The skill persists tokens to ~/.garminconnect and writes daily markdown files under the skill baseDir/health/ — these are expected artifacts for the feature. The skill does not request system-wide config changes or other skills' credentials.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install garmin-pulse
  3. After installation, invoke the skill by name or use /garmin-pulse
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.3.1
Address security scan: add disable-model-invocation to prevent autonomous agent syncs. Document stored paths (token cache, health data). Update metadata namespace.
v1.3.0
Add --verbose flag for debugging silent fetch failures. Fix SKILL.md slug to match ClawdHub. Fix README upgrade instructions for PEP 723 inline deps.
v1.2.1
Add retry with exponential backoff for transient 'No profile' auth failures. Retries up to 3 times before showing error.
v1.2.0
Improved error messages for common auth failures (No profile, 2FA, Cloudflare). Added troubleshooting section to README. Cross-platform uv install instructions.
v1.1.1
Remove printf pipe example from setup instructions (leaks password via process listings). Remove remote shell script installer from metadata (keep Homebrew only). Explicitly instruct agent not to handle passwords in chat or CLI args.
v1.1.0
Two-phase auth: separate setup (one-time, interactive) from sync (tokens only). Removes GARMIN_EMAIL/GARMIN_PASSWORD from requires.env — agent never needs credentials at runtime. Adds uv install spec to metadata. Resolves ClawHub security scan warnings for Install Mechanism, Credentials, and Instruction Scope.
v1.0.1
Fix metadata format for ClawHub registry, add homepage and credentials section
v1.0.0
- Initial release. - Syncs daily health and fitness data from Garmin Connect into markdown files. - Captures sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data. - Offers commands to sync today's data, a specific date, or a range of days. - Stores data in easily accessible markdown files, one per day. - Includes guidance for automated daily syncing with cron.
Metadata
Slug garmin-pulse
Version 1.3.1
License
All-time Installs 3
Active Installs 3
Total Versions 8
Frequently Asked Questions

What is Garminskill?

Syncs daily health and fitness data from Garmin Connect into markdown files. Provides sleep, activity, heart rate, stress, body battery, HRV, SpO2, and weight data. It is an AI Agent Skill for Claude Code / OpenClaw, with 1682 downloads so far.

How do I install Garminskill?

Run "/install garmin-pulse" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Garminskill free?

Yes, Garminskill is completely free (open-source). You can download, install and use it at no cost.

Which platforms does Garminskill support?

Garminskill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Garminskill?

It is built and maintained by freakyflow (@freakyflow); the current version is v1.3.1.

💬 Comments