Yes, skops is designed to be safer. It saves scikit-learn models without pickle, reports which types a file would construct that it does not trust by default, and builds only objects you approve. It is not a guarantee, and its own documentation says to load only files from sources you trust.
What skops does differently
Pickle can run arbitrary code while loading, which is why Python's documentation says to only unpickle data you trust. The skops documentation describes a narrower approach. Its load function traverses the file, checks known and unknown types, and constructs objects only when they are trusted, either by default or by the user.
The workflow has a deliberate pause in it:
- Call get_untrusted_types on the file. You get a list of type names the library does not trust by default.
- Read the list. In the skops example, the list includes names like an XGBoost booster and classifier.
- If every name is something you expect, pass that list as the trusted argument to load.
The documentation notes that before version 0.10 you could pass trusted equals True to skip the audit. That option was removed to encourage people to validate input first. Even the vendor's own page puts review ahead of convenience.
What it cannot do
Skops cannot persist arbitrary Python code. A custom function used inside a FunctionTransformer will not work, though most numpy and scipy functions do. That limit is part of why it is safer, and part of why some pipelines cannot move over.
The documentation also warns that, as with any deserialization format, you should only load skops files from trusted sources, and to review the reported types. A short list of types is a signal, not a proof. If the list includes something you do not recognize, stop and ask where the file came from.
Pickle and skops side by side
| Question | Pickle | skops |
|---|---|---|
| Can loading run arbitrary code | Yes, by design | Designed to prevent it |
| Review step before load | None built in | Untrusted type list |
| Custom Python functions | Supported | Not supported |
| Scope | Almost any Python object | Scikit-learn estimators and many numpy and scipy objects |
A caution on converting
Skops ships a convert command that turns pickle files into skops files. Its documentation warns that it loads the pickle to retrieve the objects, so you should only run it on files you absolutely trust. Converting an untrusted pickle runs the very code you were trying to avoid. Convert only files your own team produced, ideally inside an isolated environment.
Adopting it in a team
Pick one model and one pipeline. Save it with skops, load it in a test with the trusted list written into code review, and compare predictions with the old file. Then require new models to be saved in the new format. Existing pickle files from outside your team should be rebuilt from training code or rejected.
For the dependency side, Safeguard's SBOM and dependency scanning cover the libraries your model code imports, so version risk in scikit-learn itself is visible. A free scan is a quick start.
Quick check
Is a skops file safe to load from anyone?
No. The documentation says to load only from trusted sources and to review the untrusted type list first.
Is it safe to convert an unknown pickle with skops convert?
No. The convert command loads the pickle, so it can run code in it. Use it only on files you trust.
Sources
Last reviewed: 19 October 2026.
