PoC - modelaudit misses numpy.savez file-write-on-load (Pickle)

• Scanner under test: modelaudit==0.2.49 (cross-checked modelscan==0.8.8), Python 3.11.15, numpy 2.4.6.
• Format: Pickle (.pkl).
• Two-sided behavior: modelaudit scan evil_savez.pkl -> Clean / exit 0 (7/7 checks pass), but pickle.load(open('evil_savez.pkl','rb')) writes a .npz to an attacker-controlled absolute path on load.
• Benign marker: the reduce calls numpy.savez(<marker_path>, [13.37]) - a harmless array write. No destructive action.
• Root cause: modelaudit's pickle FILE_WRITE call-graph sink table (_FILE_OPEN_SINK_EXACT) omits zipfile.ZipFile, so numpy.savez/savez_compressed (whose open is mediated by zipfile) evade the detector that catches numpy.save.