Claude Code, Skill
gccli
Fast, script-friendly CLI for Garmin Connect.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit eec613c45c07.
SECRETS_PATH_CREDENTIAL
Why this grade
- SECRETS_PATH_CREDENTIAL Medium
Mentions a credential store path (~/.ssh, id_rsa, .npmrc, .aws/credentials, credentials.json, .netrc).
.github/workflows/e2e.yml, line 33
echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/proxy_key
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
conformance/conformance_test.go, line 133
cmd := exec.Command(os.Args[0], "-test.run=^TestSandboxDistrustsSystemRoots$", "trusted-roots-probe")
conformance/conformance_test.go, line 168
cmd := exec.CommandContext(ctx, s.bin, args...)
internal/cmd/completion_test.go, line 452
out, err := exec.Command(bashPath, args...).CombinedOutput()
Show more
README.md, line 861
gccli completion powershell | Invoke-Expression
docs/index.html, line 393
gccli completion powershell | Invoke-Expression</pre>
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
scripts/responsive-check.mjs, line 90
c.#ws = new WebSocket(url);
Secrets
Concern
reads a credential or environment file.
SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV
.github/workflows/e2e.yml, line 33
echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/proxy_key
.github/workflows/e2e.yml, line 34
chmod 600 ~/.ssh/proxy_key
.github/workflows/e2e.yml, line 35
ssh -o StrictHostKeyChecking=no -D 1080 -f -N -i ~/.ssh/proxy_key [email protected]
Show more
CLAUDE.md, line 19
make test-e2e # E2E tests (requires .env with GARMIN_EMAIL/GARMIN_PASSWORD)
.env.example, line 2
# Copy this file to .env and fill in real values for E2E tests
CLAUDE.md, line 79
- E2E tests use build tag `e2e` and require `.env` with credentials or `GARMIN_TOKEN`. Created resources are prefixed `E2E_TEST_` and cleaned up via `t.Cleanup()`.
CONTRIBUTING.md, line 125
# Create .env with GARMIN_EMAIL and GARMIN_PASSWORD
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains an encoded blob in a file that should be readable.
OBFUSCATION_ENCODED_BLOB
internal/cmd/testdata/golden/[email protected], line 1
Error case: the PUT answers 400, so the exit code is 1 (error).
internal/cmd/testdata/golden/auth_export.golden, line 5
eyJ2ZXJzaW9uIjoxLCJvYXV0aDFfdG9rZW4iOiIiLCJvYXV0aDFfc2VjcmV0IjoiIiwib2F1dGgyX2FjY2Vzc190b2tlbiI6InRlc3QtYWNjZXNzLXRva2VuIiwib2F1dGgyX3JlZnJlc2hfdG9rZW4iOiIiLCJvYXV0aDJfZXhwaXJlc19h
internal/cmd/testdata/golden/auth_export.golden, line 11
eyJ2ZXJzaW9uIjoxLCJvYXV0aDFfdG9rZW4iOiIiLCJvYXV0aDFfc2VjcmV0IjoiIiwib2F1dGgyX2FjY2Vzc190b2tlbiI6InRlc3QtYWNjZXNzLXRva2VuIiwib2F1dGgyX3JlZnJlc2hfdG9rZW4iOiIiLCJvYXV0aDJfZXhwaXJlc19h
Show more
internal/cmd/testdata/golden/auth_export.golden, line 17
eyJ2ZXJzaW9uIjoxLCJvYXV0aDFfdG9rZW4iOiIiLCJvYXV0aDFfc2VjcmV0IjoiIiwib2F1dGgyX2FjY2Vzc190b2tlbiI6InRlc3QtYWNjZXNzLXRva2VuIiwib2F1dGgyX3JlZnJlc2hfdG9rZW4iOiIiLCJvYXV0aDJfZXhwaXJlc19h
internal/cmd/testdata/golden/auth_export.golden, line 23
eyJ2ZXJzaW9uIjoxLCJvYXV0aDFfdG9rZW4iOiIiLCJvYXV0aDFfc2VjcmV0IjoiIiwib2F1dGgyX2FjY2Vzc190b2tlbiI6InRlc3QtYWNjZXNzLXRva2VuIiwib2F1dGgyX3JlZnJlc2hfdG9rZW4iOiIiLCJvYXV0aDJfZXhwaXJlc19h
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit eec613c45c07. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. reads a credential or environment file. contains an encoded blob in a file that should be readable.
Date and source
Date checked:
github.com
Commit graded: eec613c45c077e46a9e6099b02bc9afadf8b3334
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.