Upload README.md with huggingface_hub

README.md

@@ -0,0 +1,9 @@
+# PoC - modelaudit clean-passes MLflow models-from-code load-time RCE (BL-0109)
+
+Coordinated disclosure PoC for huntr (Protect AI MFV). Benign only.
+
+- Scanner: modelaudit==0.2.49 (+ modelscan==0.8.8). Format: MLflow (models-from-code).
+- `modelaudit scan evil_mfc_model/` -> 'Clean' / NO ISSUES FOUND / exit 0, but `mlflow.pyfunc.load_model('evil_mfc_model')` imports+executes evil_script.py at load time (RCE). MLflow models-from-code persists a model as a plain `.py` entrypoint + an MLmodel YAML manifest with NO pickle; modelaudit classifies the `.py` (and the MLmodel) as 'unknown format' and skips them (core.py:7005-7008), and never follows the manifest's model_code_path. `benign_mfc_model/` is the same shape with no payload (also Clean = the miss is genuine); `pickle_positive_control/model.pkl` fires CRITICAL (posix.system), proving the detector is live.
+- Benign: evil_script.py only os.system('touch <marker>') at import. No destructive action.
+
+Files: evil_mfc_model/ (MLmodel + evil_script.py; scans Clean, RCE on load), benign_mfc_model/ (control), pickle_positive_control/model.pkl (fires). Full report in huntr submission.