Pickle model-scanner evasion PoC (BENIGN, coordinated disclosure)
This repository is a benign proof-of-concept for a coordinated security disclosure
to Hugging Face / Protect AI and the picklescan maintainer. It demonstrates that a crafted
pickle can evade the automated model scanners (picklescan, modelscan) while being
structurally capable of code execution.
- The payload is benign. It is
cProfile.run("print(...)"): loading the file only prints
a harmless string. It writes no files, opens no sockets, and takes no destructive action.
- This exists solely to demonstrate the scanner gap for responsible disclosure. Do not reuse
the technique maliciously.
Reported under coordinated disclosure. Contact via the associated huntr / security advisory.
