garmin-dev — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited garmin-dev (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Cross-platform workflow for compiling, running, and packaging Connect IQ apps — plus a cached mirror of Garmin's official docs to ground every API / how-to answer in what the platform actually allows.
OS support: Windows (PowerShell 5.1+) · macOS (Bash, Apple Silicon + Intel) · Linux (Bash, Ubuntu LTS officially supported by Garmin)
The skill ships parallel script sets — one per OS family. Detect OS first, then invoke the matching command:
| OS | Detect via | Script set |
|---|---|---|
| Windows | $env:OS = "Windows_NT" (or $PSVersionTable.Platform = "Win32NT") | scripts/windows/*.ps1 |
| macOS | uname -s returns Darwin | scripts/posix/*.sh |
| Linux | uname -s returns Linux | scripts/posix/*.sh |
Every script auto-detects SDK + JDK at runtime — no per-machine path config needed. Every script reads manifest.xml from cwd for project name + device id, so always invoke from the project root (not from the skill folder).
scripts/
windows/ PowerShell — Windows
_env.ps1 shared: auto-detect SDK + JDK, parse manifest.xml
build.ps1 compile only (debug)
push.ps1 push existing .prg
run.ps1 sim + compile + push
watch.ps1 auto-rebuild on save
release.ps1 release-stripped build for one device
package.ps1 .iq package for all manifest products
posix/ Bash — macOS + Linux
_env.sh shared: OS-aware paths, JDK chain, manifest parse
build.sh, push.sh, run.sh, watch.sh, release.sh, package.sh
references/ all docs the skill consults
index.md map: what's where, when to open it
connect-iq-docs/ MIRROR of developer.garmin.com/connect-iq
reference/ sdk/api — version-pinned: api/ (Toybox) + monkey-c/ + reference-guides/
portal/ program/policy/concept docs: basics, core-topics, ux, faq, store rules
commands/ per-command behavior contract
guides/ task workflows (custom fonts, simulator data)
catalogs/ curated lookups (sensor catalog)
troubleshooting.md known errors + fixes| User intent | Windows | macOS / Linux | Notes |
|---|---|---|---|
| Start a new project (watch face / data field / widget / app) | — | — | connect-iq-docs/portal/connect-iq-basics/your-first-app.md — created via VS Code Monkey C: New Project; no CLI generator exists |
| Compile only | scripts\windows\build.ps1 | scripts/posix/build.sh | commands/build.md |
| Push existing .prg | scripts\windows\push.ps1 | scripts/posix/push.sh | commands/push.md |
| First run of session | scripts\windows\run.ps1 | scripts/posix/run.sh | commands/run.md |
| Auto-rebuild on save | scripts\windows\watch.ps1 | scripts/posix/watch.sh | commands/watch.md |
| Test release build in sim | scripts\windows\release.ps1 | scripts/posix/release.sh | commands/release.md |
Build store-ready .iq | scripts\windows\package.ps1 | scripts/posix/package.sh | commands/package.md |
| Publish / submit to store / "will it pass app review?" | — | — | connect-iq-docs/portal/submit-an-app.md + app-review-guidelines.md |
| Connect IQ developer docs (API / language / store policy) | — | — | connect-iq-docs/index.md |
| Add a custom .fnt font | — | — | guides/custom-fonts.md |
| Inject sensor data into simulator | — | — | guides/simulator-data.md |
| Make settings configurable (colors, data fields, themes) | — | — | guides/app-settings.md |
| Native UI components (toast, confirmation, progress bar, prompt, page loop) | — | — | connect-iq-docs/portal/personality-library/index.md |
| Look up which sensor API gives metric X | — | — | catalogs/sensors.md |
| Error or unexpected behavior | — | — | troubleshooting.md |
The script paths above are relative to this skill's own folder. When dispatching, expand to the absolute path on the user's machine — the location depends on install mode:
<workspace>/.claude/skills/garmin-dev/scripts/<os>/<script>--plugin-dir or marketplace): plugin install dir + /skills/garmin-dev/scripts/<os>/<script>Either way, run the script from the user's project root (where manifest.xml lives), not from the skill folder.
build.ps1 / build.sh and release.ps1 / release.sh exit when compile finishes — run foreground.run.ps1 / run.sh, push.ps1 / push.sh, watch.ps1 / watch.sh are long-lived (block on monkeydo log stream). Pass run_in_background: true in the PowerShell / Bash tool call; do not wait for exit._env_env.ps1 (Windows) and _env.sh (POSIX) are dot-sourced by every other script. They handle:
JAVA_HOME if set + valid, else searches common install paths per OS. Throws a clear error with install instructions if nothing found.connectiq-sdk-<os>-* directory in Garmin's standard install location. Throws if none found.$(basename pwd) lowercased. Override by editing line 1 of _env if you want a different binary name.manifest.xml first <iq:product> entry.Result: no per-machine paths anywhere in _env. The same file works on every user's machine.
manifest.xml, app type). A quick-map / topic-guide entry is only a candidate to verify, never the answer.scripts/<os>/<command> — _env auto-detects SDK + JDK + project + device, and direct invocation skips all of that.connect-iq-docs/portal/core-topics/ (start here — e.g. native UI widgets like Menu2/Picker live in native-controls.md, settings in properties-and-app-settings.md). connect-iq-docs/reference/api/*.md is a condensed class + enum list — for exact method signatures (params, returns, options dicts) read the full API reference: the SDK's doc/Toybox/.../<Class>.html (identical content to developer.garmin.com/connect-iq/api-docs, shipped local with the SDK). Don't infer a signature from the condensed .md or from memory — open the full page.manifest.xml; SDK + JDK are auto-detected. There is no skill-managed config that needs remembering.User: "BUILD SUCCESSFUL but the time field looks chopped off on the right."
BUILD SUCCESSFUL confirms compile passed. Rendering bugs are runtime, not compile-time. Move on.scripts/windows/run.ps1 (or scripts/posix/run.sh) — push to sim, confirm the symptom visually. Yes, the right edge of the time digits is missing.dc.setColor / drawText semantics.setColor(fg, COLOR_BLACK) before drawText. The bg argument fills the full font bounding box — not just the glyph silhouette — so it black-rectangles anything drawn earlier in that bbox area. This is a known SDK gotcha worth flagging in the project's own CLAUDE.md if the user hasn't yet.setColor(fg, COLOR_TRANSPARENT).The skill's value: dispatching the right tool (run.ps1) + pointing at the right reference (reference/api/graphics-dc.md). The diagnosis is the user's domain knowledge plus the cached gotcha — neither comes from skill defaults.
User: "How do I make the colors / which data field shows configurable?"
manifest.xml. Then check what the docs actually say about that device or feature: if a doc states the condition, quote it; if the docs are silent (e.g. a device page doesn't mention the feature), that is an inference, not a fact — flag it as such.This example shows the method — it deliberately reaches no fixed answer, because the right one depends on the actual device and on confirming the user's intent. Don't lift a conclusion from an example; run the steps for the case in front of you.
Get-Process simulator for sim check. Start-Sleep 2 after launch. JDK chain: JAVA_HOME → ~/.jdks → Microsoft → Eclipse Adoptium → Oracle Java.pgrep -x simulator for sim check. Sim launched via open -a. JDK chain: JAVA_HOME → /Library/Java/JavaVirtualMachines/*-17* → Homebrew openjdk@17.JAVA_HOME → /usr/lib/jvm/java-17-* → /opt/jdk-17*. Garmin officially supports Ubuntu LTS — other distros may need extra Qt libraries (libxcb-xinerama0, etc.) for the simulator.When in doubt about a per-OS edge case, fall through to troubleshooting.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.