The biggest risks sit in files that can run code: pickle based weights and custom Python modeling files. Safetensors weights and plain configuration carry less execution risk. A model repo is a folder of mixed artifacts, so review it file by file, not by the model name.
Map of a typical repository
| File type | What it is | Execution risk | Check |
|---|---|---|---|
| model.safetensors | Tensors in a non-code format | Low for loading | Source, hash |
| pytorch_model.bin, .pt, .pth | Usually a pickle | High if unrestricted | Restricted load, source |
| Python files (modeling, tokenization) | Custom code | High, runs with your rights | Read before enabling |
| config.json | Settings that name classes and files | Medium, because it can point at custom code | Check auto_map style entries |
| tokenizer files | Vocabulary and rules | Usually low, can reference code | Check for custom classes |
| README or model card | Documentation | None to run, can mislead | Do not copy commands blindly |
| Example scripts and notebooks | Code | High if you run them | Treat like any untrusted script |
Why config deserves a glance
Transformers decides how to build a model from its configuration. The documentation for custom models explains that to use modeling code from a repo you must set trust_remote_code, which is the moment the repo's Python files get executed. So the question to ask of config is whether it points at code that is not part of the library.
Weights: the format question
Hugging Face notes that pickle is the default format for PyTorch weights, that unpickling can execute code, and that safetensors was created as a simple serialization format to avoid that. The Transformers library prefers safetensors when it exists. See safetensors vs pickle.
Code: the explicit opt in
A flag controls whether repo code runs. Leave it off unless you have read the files. If you turn it on, pin the commit as the Transformers docs advise. Our post on trust_remote_code has a review routine.
A five minute triage
- List the files and sort them by the table above.
- Note any pickle based weights and whether a safetensors alternative exists.
- Open any Python files and skim for network calls, subprocess use and file writes.
- Check config for entries that point to repo code.
- Record the commit hash and the decision.
ls -la
grep -nE "subprocess|os\.system|eval\(|exec\(|requests\.|urllib" *.py
A grep like this only finds the obvious. It supports a read through, it does not replace one.
What this does not cover
A clean file layout says nothing about whether the model is accurate, fair or appropriate for your use. It also says nothing about the training data. Those are separate reviews.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning for the software around a model, reachability analysis, and policy gates for pull requests. A free scan is at gold.safeguard.sh/scan.
Quick check
Which file should I review first?
Any Python file in the repo and any pickle based weights, since those are the ones that can execute code on your machine.
Are model cards safe to follow?
They are documentation and cannot run on their own, but commands in them are written by the publisher. Read before pasting.
Sources
Last reviewed: 19 October 2026.
