Check H12 · provenance family · severity MEDIUM · automatic · one of the 18 Hugging Face checks
The question this check asks: does this repository say what it is — a model card describing the artifact — and on what terms you may use it, a licence field Hugging Face's own tooling can recognise? Not which licence — whether anyone bothered to declare one.
H12 mirrors the reasoning behind GitHub's C6 licence check: a documented, clearly licensed artifact signals an intent to be used, read and relied on by other people. An artifact with neither is not proof of anything on its own — but in GitHub's measured campaign data, the absence correlated strongly with throwaway, lure-shaped repositories, because nobody building something meant to be downloaded once bothers writing a card or a licence for it. We apply the same logic to Hugging Face repositories: a model, dataset or Space that says nothing about itself and grants no explicit terms is a weaker signal alone and a more useful one in aggregate.
We have not yet published a Hugging Face-specific measured split analogous to C6's GitHub figure — that is a Phase 0-style measurement we haven't run against the Hub yet, so we say that plainly rather than reuse the GitHub number as if it applied here.
H12 reads the repository's card and licence metadata. Three findings can fire independently:
A repository missing both a card and a licence fires both findings together, costing 12 points. Verdict math is the same engine used across all 18 checks: any CRITICAL finding zeroes the score and reads BLOCK outright; otherwise the score starts at 100 and fired findings' points are subtracted, floored at 0, graded green (PASS, ≥ 80), amber (REVIEW, 50–79) or red (BLOCK, < 50 or any CRIT). H12 sits in the clone dimension alongside H1–H5 — the provenance signals RepoGates checks before a repository is even used, not once it's running.
Exactly the causes C6 names on the GitHub side: personal fine-tunes pushed without a second thought, quick research uploads meant for a handful of collaborators, configuration-only repositories, one-off dataset drops. The absence is common and mostly innocent, which is why both findings are MEDIUM and warn rather than block.
The 12 September 2026 top-100 measurement (see /intel/malicious-models.html) names individual fire counts for two checks only — H7 four times, H8 fourteen times — and does not publish a separate per-check count for H12. We don't have that number yet and won't invent one. What we can say concretely: well-known, heavily used models like openai-community/gpt2 and meta-llama/Llama-3.1-8B-Instruct both carry proper cards and licences and score 100, re-confirmed 17 September 2026 — a real anchor for what "present" looks like, without a rate attached to it.
Anything about the code. A well-documented, clearly licensed model can still carry a malicious payload — that's what H6 and H7 exist to catch. A licence is a legal statement, not a scan result, which is exactly why a present licence costs zero points: presence proves nothing about safety, only that someone declared terms.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: read the model or dataset card — the rendered README on the repository's own Hub page. The declared licence, when one exists, shows in the page's sidebar metadata and in the card's YAML front-matter under a license key. With the API:
curl https://huggingface.co/api/models/OWNER/NAMEand read the licence information returned alongside the rest of the repository's metadata (swap models for datasets or spaces for those repository kinds). If nothing is there, ask the question the absence is standing in for: does this look like something meant for anyone other than the person who uploaded it?
Does a missing model card or licence mean the repository is malicious? No. It means nobody wrote a card or a licence, which describes an enormous number of legitimate research uploads and personal fine-tunes. Both findings are MEDIUM and warn, they don't block.
Does having a licence make a model safe to load? No. A licence is a legal statement, not a scan result. RepoGates records a present licence as an information line at zero points — it proves nothing about what the weights or any loading script actually do.
Does RepoGates stop git clone or a from_pretrained() call? No. Browser-initiated downloads only.
H1 Repository age — clone-dimension sibling, the repository rather than its documentation · H5 Access flags — the other clone-dimension provenance signal, whether the Hub itself restricted the repository · C6 Licence — the GitHub check H12 mirrors, same reasoning applied to a different platform.
Add RepoGates to Chrome Pricing
Numbers on this page: RepoGates' Hugging Face scoring tables (backend/repotriage/hf/catalogue.py, backend/policy/scoring.json); model examples re-confirmed via the RepoGates MCP on 17 September 2026; the mirrored reasoning is C6's, not an independently measured Hugging Face split.