The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Kaggle (forum posts, competition rules, team names) but implements high-quality mitigations.
Ingestion points: Data is fetched via mcp_client.py and shared/kaggle_cli.py.
Boundary markers: Present and advanced. shared/untrusted.py wraps all external data in <untrusted-content-[nonce]> tags using a per-block random nonce to prevent data from 'breaking out' of its container.
Capability inventory: The skill uses subprocess.run to call the Kaggle CLI and urllib.request for network access.
Sanitization: The neutralize function in shared/untrusted.py proactively strips or notes invisible Unicode characters, control codes, and homoglyphs that could be used for steganographic instruction smuggling.
[COMMAND_EXECUTION]: The skill wraps the kaggle CLI using subprocess.run with list-based arguments (no shell).
It implements a strict 'dry run' policy: operations that change account state (submissions, publishing) only execute if an explicit --yes flag is provided, ensuring user oversight.
The shared/kaggle_cli.py script includes a kind-checking mechanism to categorize commands and enforce this gate on unknown or state-changing command paths.
[CREDENTIALS_UNSAFE]: The skill handles sensitive Kaggle tokens but follows best practices.
It specifically scrubs VERBOSE and VERBOSE_OUTPUT environment variables before execution to prevent tokens from being leaked in debug logs or standard output.
save_credentials.py provides a secure way to persist tokens to disk, using os.O_EXCL and 0o600 permissions (owner-only access).

kaggle