Check H8 · execution family · severity MEDIUM · automatic — reads the file tree via the Hub API, no clone required · one of the 18 Hugging Face checks
The question this check asks: does this repository ship its weights only in pickle-based formats — .bin, .pt, .ckpt — with no safetensors alternative anywhere in the tree?
Pickle is a format property, not a content judgement. Loading it necessarily runs Python's deserialisation machinery — the exact mechanism JFrog's roughly 100 models (February 2024) and ReversingLabs' nullifAI (February 2025) both abused to run attacker code on load, as covered on the malicious-models intelligence page. safetensors is Hugging Face's alternative format, built so weights can be loaded without executing arbitrary code at all. A repository with no safetensors file anywhere means there is no way to load its weights without going through the pickle deserialisation path — whether or not anything is actually wrong with this particular file. That is a softer, different claim than H6 or H7 make: H8 says nothing about whether a pickle file contains a payload, only that the format itself carries the risk by construction.
A pickle-only finding (hf-pickle-only) is MEDIUM, 6 points. The evidence note in the scoring table, verbatim:
"format property — loading executes code, no safetensors alternative; common on older legit models, so moderate"
Six points on its own settles nowhere near REVIEW — 100 minus 6 is 94, still comfortably green PASS grade. It takes other findings alongside it, such as a Hub-flagged import (H7) or custom code on load (H9), to move the verdict. H8 sits in the "Install and run" dimension (H6–H10, H13), alongside the checks that actually open the file.
This is the check that fired most often of any of the 18, by a wide margin. In the 12 September 2026 measurement of the 100 most-downloaded models on the Hub, H8 fired 14 times — more than any other check — described in the scoring documentation itself as "a warning, not a fault," since plenty of legitimate, long- established models still ship pickle-only and have never migrated to safetensors. None of those 14 pushed a repository to BLOCK on their own; that run recorded 0 BLOCK overall.
H8 only reads the file tree — it does not open a single file. It cannot tell you whether a pickle file actually contains something unsafe (that is H7's job, reading what the Hub's own scanner found inside it) or whether the Hub's malware scanner has flagged the file directly (H6). A model that fires H8 and nothing else is simply an old-format model, not a suspect one.
And RepoGates as a whole gates browser-initiated downloads only — it does not see git clone, package-manager installs, curl, or fetches made by AI agents outside the browser. Nothing on this page, or in the extension's verdict banner, exposes scan data as a global variable a script on the page could read.
Open the model's Files and versions tab. If you see only .bin, .pt, or .ckpt files and no .safetensors file anywhere in the tree, that is the H8 signal exactly as RepoGates reads it — no download required. The same tree is available at https://huggingface.co/api/models/{org}/{name}.
Does a pickle-only model mean something is wrong with it? No — it fired on 14 of the 100 most-downloaded models on the Hub, more than any other check, precisely because plenty of legitimate, older models have simply never migrated to the safetensors format.
Why does the format matter if the file itself is clean? Because loading a pickle file runs Python's deserialisation machinery regardless of what is inside it — that mechanism is exactly what both published malicious-model campaigns exploited to run code on load.
Does H8 examine what is inside the file? No — it only reads the file tree to check whether a safetensors alternative exists anywhere in the repository. What is actually inside a pickle file is H7's job.
H7 Hub pickle-import scan — the check that actually opens what H8 only notices is there · H6 Hub malware scan hit — the Hub's own malware verdict on the same files · H13 Hub scan incomplete — what it means when that deeper scan has not finished yet.
Add RepoGates to Chrome Pricing
Numbers on this page: roster measurement and false-positive figures from site/intel/malicious-models.html, 12 September 2026; campaign context from JFrog (February 2024) and ReversingLabs "nullifAI" (February 2025); weights and evidence notes from the product's scoring table.