model-artifact-security
Skill0 starsChanged 12 days agoMITView on GitHub
Secure ML model supply chains and artifacts — unsafe serialization (pickle, joblib, PyTorch .pt/.bin, Keras Lambda layers), scanning with ModelScan/picklescan/fickling, preferring safetensors, model provenance and signing, registry access control, trust_remote_code risks, and dataset poisoning checks. Use when downloading models from hubs (Hugging Face), operating a model registry, or reviewing ML pipelines (OWASP LLM03/LLM04).
- Installs packages
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-exfiltration-investigationSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 37
Avoid trust_remote_code=True unless the remote code is reviewed and pinned.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Model Artifact Security
Serialization risk
| Format | Risk |
Python pickle / joblib / PyTorch legacy .pt, .bin, .pkl | Arbitrary code execution on load (__reduce__) |
Keras .h5/.keras with Lambda layers | Code execution on load (safe_mode mitigates in Keras 3) |
| ONNX, TensorFlow SavedModel | Lower risk but custom ops/graphs can still be abused |
| safetensors | Tensors only, no code — preferred |
| GGUF | Weights + metadata; parser vulnerabilities possible in loaders |
torch.load(path, weights_only=True) (default since PyTorch 2.6) restricts unpickling to tensors/primitives — do not override for untrusted files.
Scanning
pip install modelscan && modelscan -p ./downloaded_model/
pip install picklescan && picklescan --path ./model.bin
fickling --check-safety model.pkl # static analysis of pickle opcodesHugging Face shows pickle/malware scan results per file — still scan locally.
Supply-chain controls
- Allow-list approved publishers/models; mirror approved models into an internal registry (MLflow, SageMaker Model Registry, Vertex Model Registry, Artifactory) — production loads only from there, pinned by revision/commit hash (
revision=infrom_pretrained). - Avoid
trust_remote_code=Trueunless the remote code is reviewed and pinned. - Sign models and verify on load (e.g., OpenSSF Model Signing / Sigstore-based
model_signing). - Generate model cards/AI-BOMs (CycloneDX ML-BOM) recording datasets, base models, licences.
- Registry access: write access restricted; changes audited; separate dev/prod.
Training data integrity
Provenance of datasets, access control on training buckets, poisoning checks (outlier/duplicate detection, label audits), and evaluation on trusted holdout sets after each retrain.
Related skills
sca-dependency-risk, artifact-signing, sbom-generation, ai-incident-response
References
- OWASP LLM03:2025 Supply Chain: https://genai.owasp.org/llmrisk/llm032025-supply-chain/
- ModelScan: https://github.com/protectai/modelscan
- Hugging Face pickle security: https://huggingface.co/docs/hub/security-pickle
- OpenSSF model signing: https://github.com/sigstore/model-transparency
- safetensors: https://github.com/huggingface/safetensors
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.