kaggle-finetune
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads dataset files from Kaggle using the official Kaggle CLI and fetches model weights from HuggingFace Hub using the Transformers library. These are well-known, trusted services for AI development.
- [COMMAND_EXECUTION]: Shell commands are used appropriately for package management (
pip install), environment variable configuration (export), and dataset management (kaggle datasets download). These operations are necessary for the skill's primary purpose and do not perform suspicious actions. - [REMOTE_CODE_EXECUTION]: While the skill involves running Python scripts that interact with remote APIs (Kaggle and HuggingFace), these interactions are limited to authenticated data retrieval and model downloading through official SDKs. There is no evidence of arbitrary code execution from untrusted sources.
- [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to set their Kaggle API token as an environment variable (
KAGGLE_API_TOKEN) using a placeholder (KGAT_xxxxx). It does not contain or encourage the hardcoding of secrets.
Audit Metadata