kaggle

• Outcome: Review
• Latest audit: Oct 3, 2026 · 3:56 PM UTC
• Version: 3.0.1

Overview

This Kaggle skill is mostly coherent and disclosed, but it can mutate a Kaggle account broadly and some permission/gating metadata does not fully match that authority.

Install only if you are comfortable giving the skill access to your Kaggle account for submissions, notebook runs, dataset/model publishing, and badge automation. Use the top-level scripts/kaggle_skill.py entry point, review every dry run, keep KAGGLE_SKILL_READ_ONLY=1 when you only want reads, and do not run badge phase scripts directly unless you intentionally want the account changes they perform.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (98)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents this as a broad 'Unified Kaggle skill' for handling user requests about Kaggle topics. However, the supplied code is not a general Kaggle skill/router; it is a specific automation orchestrator focused on attempting to earn Kaggle badges through multiple phases. It checks credentials, determines the signed-in username, tracks progress, resumes unfinished badge attempts, and runs phase modules. This is a materially narrower and more action-oriented behavior than the declared purpose. While badges are mentioned in the description, the code’s primary purpose is automated badge collection, which is an undeclared operational capability and does not accurately represent a general Kaggle skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents this as a broad routing skill for any explicitly Kaggle-related user request. However, the supplied code is not a general Kaggle skill; it is a narrow badge automation module focused on performing account actions on Kaggle to earn specific badges. It actively creates and uploads content, forks notebooks, and manipulates Kaggle resources through the CLI, which is a much more specific and operational behavior than the description suggests. While 'Kaggle badges' are mentioned in the description, the overall declared purpose materially overstates generality and fails to disclose that the code's primary function is automated badge farming/content publication rather than general Kaggle assistance. This is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description presents a broad routing/usage description for a general-purpose Kaggle skill, but the supplied code implements a narrow automation workflow for earning Kaggle streak badges. While badges are mentioned in the declared purpose, the actual code goes much further than simple Kaggle-topic handling: it performs live Kaggle actions, including dataset-list API calls and competition submission, and generates a reusable executable script for repeated daily use. Those are concrete operational capabilities not reflected in the declared description or permissions. This is therefore a description-behavior mismatch, primarily because the code’s true purpose is automated streak-badge execution and local script generation, not a general unified Kaggle skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description claims this is a unified Kaggle skill used when the user mentions Kaggle, suggesting the code should support Kaggle-specific tasks or platform interaction. In reality, the code only generates deterministic sample data, serializes it to JSON, prints it, and writes it to a local file. There is no Kaggle API usage, no web/network access, no notebook/backend integration, and nothing tied to Kaggle concepts. This is a material mismatch in primary purpose and actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description presents this as a general-purpose unified Kaggle skill for many Kaggle-related tasks. The code, however, is a specific competition-submission validator: it checks CSV columns, row counts, IDs, empties, and numeric finiteness against a sample submission. It can search local folders and use Kaggle credentials/API/CLI to list competition files and download a sample submission, but only in service of that validation workflow. This is a material description-to-behavior mismatch because the declared purpose significantly overstates the breadth of functionality and does not accurately characterize the code's primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a general-purpose Kaggle skill covering many Kaggle-related topics and actions. The supplied code, however, implements a narrow and sensitive capability: persisting Kaggle authentication credentials from environment variables into local files under ~/.kaggle. That is materially more specific than the declared purpose and includes handling of sensitive secrets and file-system writes, neither of which is reflected in the declared permissions or description. While 'Kaggle account setup' is mentioned in the description, the actual code does not support the broad set of listed Kaggle use cases; instead it focuses on credential persistence. This is a description/behavior mismatch due to undeclared sensitive credential handling and a substantially narrower actual purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description frames this as a broad Kaggle-focused routing skill, triggered by Kaggle-related user mentions. The supplied code does not implement Kaggle access, navigation, dataset/model/notebook handling, competitions, forums, account setup, or any Kaggle-specific integration. Instead, it is a standalone safe ZIP extraction helper for untrusted archives. While the docstring mentions Kaggle archives as an example of untrusted input, that does not make the code a Kaggle skill. Its primary purpose and capabilities are materially different from the declared description, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is a Kaggle-domain routing/usage description, implying functionality tied to Kaggle resources or triggers. The supplied code does not perform Kaggle-specific actions such as accessing Kaggle competitions, datasets, notebooks, forums, or account features. Instead, it provides a general-purpose defensive output layer for safely emitting untrusted content. While this may support a Kaggle skill internally, the code chunk’s actual purpose is materially different from the declared purpose and introduces capabilities not described in the declaration. Therefore, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

`SKILL.md`. Run every command from the user's working directory as

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill is designed to interact with stored Kaggle credentials in environment variables and files under ~/.kaggle. Even though the document says not to echo or read credential files aloud, any skill that enumerates credential locations and supports credential-dependent actions increases the blast radius of implementation mistakes or prompt-injection-driven misuse, especially in an agent context where secrets may be reachable.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

|---|---|---|
| 1 | API token | `KAGGLE_API_TOKEN`, then `~/.kaggle/access_token` |
| 2 | Legacy key | `KAGGLE_USERNAME` + `KAGGLE_KEY`, then `~/.kaggle/kaggle.json` |
| 3 | OAuth login | `kaggle auth login`, stored in `~/.kaggle/credentials.json` |

The commands that read the account through Kaggle's MCP server (`status`,
`leaderboard`, `competitions`, `details`, `watch`, `episodes`, `writeups`)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file does far more than route or assist with Kaggle-related requests: it programmatically creates and uploads notebooks, datasets, and models to the user's Kaggle account. That is a material capability expansion with side effects on a third-party account, creating risk of unauthorized publishing, account misuse, and reputational or policy harm if invoked unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code is explicitly designed to automate earning badges by mass-creating/forking/tagging/uploading Kaggle assets, which is unrelated to ordinary user assistance and encourages manipulative platform activity. Even if not overtly malicious, this can abuse a user's authenticated session to generate spammy content, trigger platform enforcement, and misrepresent user activity.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file implements active Kaggle account automation: pushing kernels, polling executions, downloading outputs, and creating datasets/models to earn badges. That behavior materially exceeds the skill’s stated routing/selection purpose and creates a capability for non-trivial account actions, which is dangerous because invoking the skill could publish artifacts or mutate a user account without a clearly aligned product need.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The dataset pipeline uploads a notebook, waits for remote execution, downloads produced files, and creates a Kaggle dataset from the output. In the context of a skill described as unified Kaggle routing, this is an unjustified privileged workflow that can create persistent account resources and consume platform resources without the user explicitly requesting publication.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section creates and publishes a Kaggle model artifact from notebook output, again going beyond a routing-oriented skill description. Model publication is a stronger account mutation than simple retrieval because it creates a durable artifact under the user identity and could be abused for spam, reputation manipulation, or unintended disclosure of generated outputs.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · modules/badges/scripts/phase_5_streaks.py (reported line 109)May include surrounding context.

python

def _print_scheduling_instructions(script_path: Path) -> None:
    """Print instructions for the user to set up their own daily scheduling."""
    system = platform.system()

    print("\n  --- Manual scheduling instructions ---")

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · modules/badges/scripts/phase_5_streaks.py (reported line 161)May include surrounding context.

python

def _print_scheduling_instructions(script_path: Path) -> None:
    """Print instructions for the user to set up their own daily scheduling."""
    system = platform.system()

    print("\n  --- Manual scheduling instructions ---")

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · modules/benchmarks/README.md (reported line 8)May include surrounding context.

bash

kaggle benchmarks init --yes
kaggle benchmarks tasks push my-task -f task.py --wait
kaggle benchmarks tasks run my-task -m gemini-2.5-pro --wait
kaggle benchmarks tasks status my-task
kaggle benchmarks tasks download my-task --include-source

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · modules/references/cli-reference.md (reported line 269)May include surrounding context.

bash

kaggle benchmarks init --yes
kaggle benchmarks tasks push my-task -f task.py --wait
kaggle benchmarks tasks run my-task -m gemini-2.5-pro --wait
kaggle benchmarks tasks status my-task
kaggle benchmarks tasks download my-task --include-source

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · modules/competitions/references/competition-operations.md (reported line 124)May include surrounding context.

md

- Only your latest two submissions stay in play. A new one replaces the older
  of the two.
- Ratings settle over many episodes. Do not judge a submission from its first
  few games.
- `episodes <submission-id>` lists the games with rewards and opponents.
  `episodes --replay <episode-id>` and `episodes --logs <episode-id>` save a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modules/references/cli-reference.md (reported line 80)May include surrounding context.

md

Public datasets, models, and notebooks download without any credential.

`kaggle auth print-access-token` prints the OAuth access token for use as a
bearer token elsewhere. It prints a secret: never run it where the output is
logged or shown, and the skill's `cli` command refuses it. `kaggle auth
revoke` revokes that token.

Static analysis

No suspicious patterns detected.