Check H2 · provenance family · automatic · one of the 18 Hugging Face checks
The question this check asks: how old is the Hugging Face account that owns this repository? Not the model, dataset, or space — the author. A repository can be new for good reasons; an author who didn't exist until shortly before uploading it is a different kind of new, and it's the one thing that's genuinely expensive for an attacker to fake convincingly.
H2 is the Hugging Face mirror of C1, RepoGates' owner-account-age check for GitHub — the single highest-value provenance signal in the 22-check standard, applied here to the Hub. A fresh account with no prior public history is the cheapest thing to manufacture and the hardest to hide, because a creation date is a public field that doesn't backdate. Years of unrelated activity on one account are much harder to fabricate than a plausible-looking model card.
H2 reads the author account's creation date and is HIGH severity, costing 18 points when it fires — a single tier, with no separate CRITICAL band the way C1 has on GitHub. The scoring table's evidence note states the check's own boundary plainly:
"mirrors owner-account-age HIGH; user accounts only (orgs expose no createdAt)"
The verdict engine is shared across all 18 Hugging Face checks and the 22 GitHub checks: any CRITICAL finding drops the score to 0 and the verdict to BLOCK; otherwise the score starts at 100 and subtracts every fired penalty, floored at zero — 80 and above is PASS, 50–79 is REVIEW, under 50 or any CRIT is BLOCK. A lone H2 finding, with nothing else fired, leaves the score at 82 — still inside the PASS band; H2 tips a verdict only in combination with other findings. H2 also feeds the Clone dimension verdict alongside H1, H3–H5, and H12.
Critically, that dimension's PASS still requires every check in it to have actually run — and H2's organisation skip is treated as a listed no-input skip, the same handling the OpenSSF Scorecard check gets on GitHub when no Scorecard run exists: it shows up as "skipped," never silently, and never as a withheld PASS.
H2 fired zero times in the 12 September 2026 measurement of the 100 most-downloaded models on the Hub, published on the malicious-models intelligence page — only H7 (Hub pickle-import scan, 4 times) and H8 (pickle-only weights, 14 times) produced REVIEW findings in that run. Two things explain the zero: popular authors tend to have long-standing accounts, and a meaningful share of the top 100 sit under organisation namespaces in the first place, where H2 doesn't run at all. This session's own re-confirmation on 17 September 2026 illustrates the second point directly — meta-llama/Llama-3.1-8B-Instruct and openai-community/gpt2 both scored PASS 100, and for both, H2 is simply absent from the picture rather than passing or failing, because meta-llama and openai-community are organisations.
This is the one limitation worth stating plainly rather than treating as a gap to paper over: H2 is skipped entirely for organisation-owned repositories, permanently, because Hugging Face's API exposes no createdAt field for an organisation account — only for individual users. That's not a bug we intend to fix; it's a limit of the data the Hub itself makes public, and it will stay a limit for as long as that API shape does. A malicious or compromised organisation account gets no age signal from this check at all — its protection has to come from the other 17 checks, particularly H4 (lookalike organisation), which looks at the namespace itself rather than an account age field that doesn't exist for it. And for accounts H2 can read: an aged or purchased account passes this check by construction, the same aged-account gap C1 has on GitHub. RepoGates as a whole also gates browser-initiated downloads only — it doesn't see git clone, pip install, a Python from_pretrained() call, or fetches made by an AI agent outside the browser, and it never exposes this verdict as a JavaScript global a page's own script could read.
Start with the repository's own API response — https://huggingface.co/api/models/{org}/{name} (swap models for datasets or spaces as needed) — to confirm whether the namespace is a personal account or an organisation; the URL structure alone is often a giveaway, but the response settles it. For a personal account, that account's own public profile page on huggingface.co shows its activity history the way GitHub's does. For an organisation, there is nothing further to check here by design — that is exactly the permanent gap described above, and it's what H4 exists to cover instead.
Why doesn't RepoGates check the age of organisation accounts? Because Hugging Face's own API doesn't expose a creation date for organisation accounts — only for individual user accounts. This isn't a bug we haven't gotten to; it's a permanent limitation of the data the Hub makes available. H2 skips for an organisation-owned repository without withholding a PASS, the same way the OpenSSF Scorecard check skips on GitHub when no Scorecard run exists.
Does that mean organisation-owned models are less scrutinised? On this one check, yes — H2 simply isn't part of the picture for an organisation namespace. It doesn't mean the repository passes unchecked: the other 17 checks, including repository age, traction mismatch, and the Hub's own malware and pickle scans, still run in full regardless of whether the owner is a person or an organisation.
Does RepoGates stop git clone or pip install? No. RepoGates gates browser-initiated downloads on huggingface.co only. It doesn't see git clone, pip install, a Python from_pretrained() call, or fetches made by an AI agent outside the browser.
H1 Repository age — the repository rather than the account, and a check that never skips · H4 Lookalike organisation — the check that covers an organisation namespace this one cannot age-check at all · C1 Owner account age — the same reasoning on GitHub, the single highest-value provenance signal in the 22-check standard.
Add RepoGates to Chrome Pricing
Numbers on this page: malicious-models measurement of 12 September 2026 (top 100 most-downloaded models on the Hub); live re-confirmation via the RepoGates MCP on 17 September 2026; weights from the product's scoring table.