190  picklescan(1) - Kailash Tool Reference

190.1 picklescan

picklescan - Picklescan — static security scanner for pickle/PyTorch model files: flags dangerous globals and unsafe opcodes.

Layer ATTACK
Category a-04-model-supply-chain
Safety class safe
Licence MIT
Upstream github.com/mmaitre314/picklescan

190.1.1 NAME

picklescan - Picklescan — static security scanner for pickle/PyTorch model files: flags dangerous globals and unsafe opcodes.

190.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

pip install picklescan
picklescan --huggingface ykilcher/totally-harmless-model
https://huggingface.co/ykilcher/totally-harmless-model/resolve/main/pytorch_model.bin:archive/data.pkl: global import '__builtin__ eval' FOUND
----------- SCAN SUMMARY -----------
Scanned files: 1
Infected files: 1
Dangerous globals: 1

190.1.3 DESCRIPTION (upstream)

Security scanner detecting Python Pickle files performing suspicious actions. Scan a malicious model on Hugging Face: pip install picklescan picklescan –huggingface ykilcher/totally-harmless-model The scanner reports that the Pickle is calling eval() to execute arbitrary code: https://huggingface.co/ykilcher/totally-harmless-model/resolve/main/pytorch_model.bin:archive/data.pkl: global import ‘builtin eval’ FOUND Scanned files: 1 Infected files: 1 Dangerous globals: 1 The scanner can also load Pickles from local files, directories, URLs, and zip archives (a-la PyTorch): picklescan –path downloads/pytorch_model.bin picklescan –path d

190.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (4 matches, e.g. test.yml, conda.yaml). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

190.1.5 SEE ALSO

ref: v1.0.5-unstable-2026-09-01 - verified 2026-10-14