Skip to content

v2.5.0 — Upstream refresh, security pass, CI

Choose a tag to compare

View all tags
@shepsci shepsci released this 02 Oct 14:05
v2.5.0
a869141
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes found by running the skill against today's Kaggle CLI (2.2.4) and MCP server (71 tools), a security pass, a refresh of every reference, and CI. The full list is in CHANGELOG.md.

Highlights

Fixed

  • The bundled Kaggle MCP server loads in Claude Code, and sign-in to it completes. .mcp.json lacked "type": "http", and it now names the OAuth client ID that Claude Code needs.
  • cli_execute.sh and poll_kernel.sh detect the end of a notebook run and stop after a maximum wait.
  • list_competitions.py and competition_details.py report real team counts, metrics, file sizes and votes, and print valid JSON.
  • Server errors, and Kaggle CLI commands that fail with exit status 0, are no longer reported as success.
  • list_writeups.py filters winners and reports a denial as a denial.

Security

  • The skill pre-approves only Read, Grep and Glob. It no longer pre-approves Bash or WebFetch.
  • Text from Kaggle is printed inside blocks whose tag has a random suffix, so the text cannot close its block.
  • Publish scripts refuse a folder that contains a credential file, and the kagglehub download scripts refuse an --output-dir that has files in it.
  • The credential checker only reads. --verify makes a call that the server checks.

Changed

  • cli_competition.sh is split into cli_download.sh and cli_submit.sh. Submitting is a dry run unless --yes is given.
  • One credential checker, check_all_credentials.py. check_credentials.py and check_registration.py are removed.
  • Exit codes are the same across scripts; see SKILL.md.

Added

  • CI on every pull request, and a weekly job that compares Kaggle's MCP tool list, CLI command tree, package versions and OAuth registration answer with committed snapshots.
  • competition-operations.md: what to check before and after a submission.
  • A root plugin.json in the Agent Plugins format, and an eval suite under evals/.

Verification

  • 1027 offline tests pass on Python 3.11, 3.12 and 3.13.
  • 107 read-only live tests pass against Kaggle CLI 2.2.4 and the MCP server.
  • The Claude Code and Codex plugin validators pass, and both clients install the plugin.
Assets 2
Loading