write-kaggle-benchmarks
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
kaggleandkaggle-benchmarksPython packages, which are official libraries provided by the vendor for interacting with their platform. - [COMMAND_EXECUTION]: The agent is instructed to use the
kaggleCLI for authentication, task management, and execution. Additionally, it runs local Python scripts written by the agent/user to validate benchmark logic before pushing it to the server. - [PROMPT_INJECTION]: The skill explicitly defines a 'Pacing' section that forbids the agent from chaining commands autonomously. It mandates that the agent state its intent and wait for user approval before every step, serving as a strong guardrail against unintended command execution.
- [DATA_EXFILTRATION]: The core functionality involves pushing code and data to Kaggle's official servers (
kaggle b t push). This behavior is transparent, documented, and aligned with the skill's stated purpose of managing benchmarks on the Kaggle platform. - [SAFE]: No evidence of malicious behavior, obfuscation, persistence mechanisms, or unauthorized privilege escalation was found in the skill's instructions or metadata.
Audit Metadata