Check H5 · provenance family · automatic · one of the 18 Hugging Face checks
The question this check asks: what has Hugging Face itself already decided about this repository's access? A repository can be gated — download requires accepting terms first — or disabled — the Hub has pulled it. They look similar to a casual visitor; they mean opposite things.
H5 reads two distinct flags off the repository and scores them differently on purpose, because they represent different facts. The scoring table's evidence notes make the distinction explicit:
hf-disabled: "the Hub itself pulled it"
hf-gated: "terms before download — informational"
A disabled repository is the strongest signal this check can carry, because it isn't an inference — it's Hugging Face's own moderation action, already taken. The malicious-models measurement shows exactly this: both nullifAI models, glockr1/ballr7 and who-r-u0000/0000…0000, had already been disabled by Hugging Face by the time the roster ran on 12 September 2026, and H5 combined with H13 (Hub scan incomplete) produced a REVIEW verdict on both — not a clean pass, and not silence.
hf-disabled is HIGH severity, costing 12 points. hf-gated is INFO, costing 0 points — it shows up in the findings list so you can see the repository requires accepting terms, but it never moves the score. The verdict engine shared across all 18 Hugging Face checks and the 22 GitHub checks starts the score at 100 and subtracts every fired penalty, floored at zero, with any CRITICAL finding instead dropping the score straight to 0 and BLOCK. 80 and above is PASS, 50–79 is REVIEW, under 50 (or any CRIT) is BLOCK. On the two nullifAI models, hf-disabled combined with H13's own penalty was enough to land the verdict at REVIEW rather than PASS — see the measurement page for the worked example. H5 also feeds the Clone dimension verdict alongside H1–H4 and H12.
hf-gated fires constantly and correctly on entirely legitimate repositories — plenty of well-known model families require accepting terms before download, and because it's worth 0 points, it never turns a gated repository into a false REVIEW or BLOCK by itself. hf-disabled is a different story: it fired on both nullifAI models in the 12 September 2026 measurement, correctly, since the Hub had genuinely already disabled them. This session's own re-confirmation on 17 September 2026 checked two long-established, actively maintained repositories — meta-llama/Llama-3.1-8B-Instruct and openai-community/gpt2 — and both scored PASS 100, with no access-flag finding pulling the score down.
Disabled is a lagging indicator — it only reflects what the Hub has already caught, reviewed, and acted on, which takes time. The clearest illustration is in this session's own numbers rather than a hypothetical: star23/baller13 — the still-live ReversingLabs-family repository — was already blocked by RepoGates' campaign blocklist on 12 September 2026, but it took until this session's 17 September 2026 re-confirmation for the Hub's own scanner to flag it independently, roughly five months after ReversingLabs' original report. For that entire window, H5 had nothing to say about it, because the repository was neither disabled nor gated — it was simply still there. An access flag tells you what the platform has decided, never what's actually inside the files; that's the job of H6 through H13. RepoGates as a whole also gates browser-initiated downloads only — it doesn't see git clone, pip install, a Python from_pretrained() call, or fetches made by an AI agent outside the browser, and it never exposes this verdict as a JavaScript global a page's own script could read.
Open the repository page directly. A disabled repository shows a takedown notice in place of the file tree and model card — there's nothing subtle about it. A gated repository shows a banner asking you to accept terms and share contact details before the Files tab becomes usable. Both states are also carried in the repository's own API response at https://huggingface.co/api/models/{org}/{name} (swap models for datasets or spaces as needed), so you don't need to click through the UI to confirm either one.
Is a gated Hugging Face repository dangerous? No, and H5 treats the two access states completely differently for exactly this reason. Gated means you have to accept terms before downloading — common for licensed model families — and it's informational only, worth 0 points. Disabled means Hugging Face has already pulled the repository, which is worth 12 points at HIGH severity, because that's the Hub acting on something, not just gatekeeping.
If a repository is disabled, why does RepoGates need to check anything else? Because disabled is a lagging indicator, not a leading one — it only reflects what the Hub has already caught and acted on. The two nullifAI models scored REVIEW through H5 plus H13 (Hub scan incomplete), not a clean pass, but a still-live, still-downloadable repository like star23/baller13 shows the other side: it took the Hub's own scanner roughly five months after ReversingLabs' public report to flag it independently, which this session's own re-confirmation on 17 September 2026 caught directly.
Does RepoGates stop git clone or pip install? No. RepoGates gates browser-initiated downloads on huggingface.co only. It doesn't see git clone, pip install, a Python from_pretrained() call, or fetches made by an AI agent outside the browser.
H13 Hub scan incomplete — the check that combined with a disabled flag to produce a REVIEW rather than PASS verdict on both nullifAI models · H6 Hub malware scan hit — the CRITICAL-severity version of the Hub taking action, one step past a disabled flag · H12 Model card and licence — another check reading what the repository itself declares, rather than its file contents.
Add RepoGates to Chrome Pricing
Numbers on this page: malicious-models measurement of 12 September 2026 (top 100 most-downloaded models on the Hub; JFrog and ReversingLabs "nullifAI" campaign reports as published); live re-confirmation via the RepoGates MCP on 17 September 2026; weights from the product's scoring table.