Check H18 · agent-provenance family · defined, not yet active · one of the 18 Hugging Face checks
The question this check asks: did an AI chat assistant or an MCP/tool directory lead you to this model, dataset or Space? Not whether the repository mentions AI — whether the route you took to it went through one. Today, RepoGates cannot answer that question for Hugging Face at all, and this page says so plainly rather than leaving the roster entry to speak for itself.
H18 is named as the Hub's counterpart to GitHub's C22 AI-agent provenance, which is live: an assistant's recommendation reads as vetting to the person receiving it, and it is not vetting. Island's July 2026 AgentBaiting research showed the mechanism working on GitHub — over 800 FakeGit repositories posing as AI Skills or MCP servers, more than 600 seeded registry listings, and chat assistants recommending the fakes as confidently as anything legitimate. Nothing about that mechanism is specific to GitHub; an assistant asked for a model or a dataset can recommend a Hugging Face repository exactly as readily as it can recommend a GitHub one, and the Hub already hosts confirmed attacker-controlled repositories for it to find — the JFrog campaign and ReversingLabs' nullifAI, both catalogued on the malicious models intelligence page. A model an assistant recommends deserves exactly the same scrutiny as a link a stranger emails you.
What RepoGates does not yet have is a way to see that recommendation happen on huggingface.co. C22 works because a browser extension holds permission on an enumerated list of AI and MCP-directory hosts and watches tab lineage at the moment someone navigates to GitHub. No such extension watches huggingface.co yet.
H18 does not run today. There is no scoring-table entry, no penalty, and no code path that sets it — the roster names the check because the vetting standard defines it, not because a score exists for it. Every Hugging Face verdict reports this row as “Not checked”: not PASS, not an INFO line, not a skip dressed up as clearance — an honest gap the board states rather than hides. The design brief mirrors C22 directly, because the two are the same idea aimed at two platforms: only a browser extension present at the moment you navigate to a model, dataset or Space page can see whether an AI chat surface or an MCP/tool directory sent you there. No backend call, no API crawl and no repository-content scan can reconstruct that after the fact — C22 cannot either, which is why it is marked extension only rather than automatic even on GitHub, where it does run. Shipping the Hugging Face side is tracked in the product roadmap as HF-3, alongside the preflight verbs and MCP platform argument that would need to exist first (HF-2). Neither has shipped, and nothing on this page, in the extension, or in the MCP server claims otherwise.
None, because nothing runs. A check that does not execute cannot misfire. That is a different claim from “zero false positives measured” — which is what a check earns after running against real traffic and turning up nothing wrong — and we are careful not to blur the two. H18 has not been measured because it has not shipped.
Everything, today — by construction, since it is inactive. Once it ships, expect the same boundaries C22 already documents: it would see browser navigations only, from an enumerated list of surfaces it is told about; it would not see what you asked an assistant or what it said, only that a navigation crossed from one of those surfaces to a Hugging Face page; and it would not read the repository itself — a recommended model that trips nothing else would not be blocked on that basis alone, because a recommendation is not evidence.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, huggingface_hub, or fetches made by AI agents outside the browser; a Python from_pretrained() call is never a shell line any hook sees. That limit will still apply after H18 ships — it would see a person who followed a recommendation into a browser download, never an agent that fetches the weights itself. This page, like every check page, exposes no globals a script running on it could read.
Since nothing automated exists for this yet, the manual version is the only version: treat any model, dataset or Space an assistant hands you as an unverified search result, not a referral. Open the repository's Files tab and its model card and read them as if a stranger had linked you the page. For a user account (organisations expose no creation date), the Hub's own API gives you the same signal H2 reads automatically:
curl -s https://huggingface.co/api/models/ORG/NAME \
| jq '{author: .author, downloads: .downloads, likes: .likes, createdAt: .createdAt}'
curl -s https://huggingface.co/api/users/AUTHOR/overview | jq .Then verify the publisher out of band — a project website, a package on a registry you already trust, a named person with a history — the same discipline the vetting standard recommends for any agent-discovered repository, on any platform, whether or not a check exists to automate it yet.
Does RepoGates currently tell me whether an AI assistant recommended this Hugging Face model? No. H18 is defined in the 18-check roster but has no backend penalty and no browser extension release for huggingface.co behind it. Every Hugging Face verdict reports this row as “Not checked” — not PASS, not a clean bill, an honest gap — until that extension ships.
Why publish a page for a check that does not run yet? So the gap is documented rather than silent. A check that quietly does nothing and a check that is defined, named and marked not-yet-active read very differently to anyone relying on a verdict. Listing it as “Not checked” now means it can never later be mistaken for a check that ran and found nothing.
Does RepoGates stop an AI agent from downloading this model itself? No. RepoGates gates browser-initiated downloads only. It does not see git clone, huggingface_hub, curl, or a Python from_pretrained() call — none of those is a browser download, and a from_pretrained() call is never a shell line any hook watches either. H18, even once it ships, will only ever see a human following a recommendation into a browser tab.
H2 Author account age — the provenance signal a person can check by hand today, while H18 does not yet run · H14 Agent config files — instruction files an agent would read before you do, once you follow a recommendation this far · H16 MCP shell-launch config — what a recommended repository's own agent configuration might do next · C22 AI-agent provenance (GitHub) — the same check, live, on the platform where the extension already ships.
Add RepoGates to Chrome Pricing
Numbers on this page: Island, AgentBaiting, 20 July 2026 (800+ Skill and MCP imposters, 600+ registry listings, assistant behaviour, as measured on GitHub); JFrog campaign (~100 models, February 2024) and ReversingLabs' nullifAI (2 models, February 2025), both as published on the malicious models intelligence page. H18's own status — no backend penalty, no shipped extension, tracked as roadmap items HF-2 and HF-3 — is a statement of the product's current state, not a measurement.