torch.load(hf_hub_download(...), weights_only=False) runs whatever code the owner of that repository put in the file, and trust_remote_code=True without a pinned revision runs whatever Python the repository holds on the day you download it. This skill finds those and eight other model-loading mistakes in your Python code and notebooks before they run, and tells you how to fix each one.

Your agent runs a scanner on .py files and the code cells of Jupyter notebooks (reported at the notebook's own line, including !wget and !curl downloads and %pip install lines). It knows torch.load's defaults (weights_only=True from torch 2.6, full pickle before 2.6 or when a pickle_module is passed) and reads requirements files, pyproject.toml, environment.yml and lock files for the torch version. It follows a download through variables, with blocks, loops and files written from it within each function, tells your own checkpoints and PyTorch's own weight hosts (REVIEW) apart from downloaded or uploaded files (BLOCK), and skips comments and docstrings. It never imports, loads or runs anything. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Tokens and passwords are never printed.

What it checks

BLOCK (fix before shipping)

• M01: pickle, joblib, pandas.read_pickle, numpy allow_pickle, Keras safe_mode=False or torch.load with weights_only=False on a downloaded or uploaded file
• M02: trust_remote_code=True without a pinned commit revision
• M03: model files downloaded over plain http from a host on the internet
• M04: Hugging Face tokens written in code or notebooks

REVIEW (check before release)

• M11: the same unsafe loaders on files the code does not download itself, or on PyTorch's own weight hosts
• M12: Hugging Face Hub downloads without a commit hash in revision
• M13: use_safetensors=False or safe_serialization=False
• M14: torch.hub.load from an unpinned GitHub branch
• M15: torch pinned below 2.6 (CVE-2025-32434), in a dependency file or a notebook %pip line, in a project that calls torch.load
• M16: safe loading turned off for the whole process (TORCH_FORCE_NO_WEIGHTS_ONLY_LOAD, Keras enable_unsafe_deserialization)

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example model service, and the real report the scanner produces on the risky one

Limits

It reads each file as written: a file counts as downloaded only when the download is visible in the same file. Paths passed in as function arguments, model names from config files, the installed torch version, dataset loading, ONNX, SavedModel and GGUF files, and vulnerabilities in other packages are not checked. Notebooks over 1 MB are listed as not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 13 files: SKILL.md, the scanner in scripts/ (6 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (4 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.