# PoC - modelaudit misses numpy.savez file-write-on-load (Pickle)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only.

- Scanner under test: `modelaudit==0.2.49` (cross-checked `modelscan==0.8.8`), Python 3.11.15, numpy 2.4.6.
- Format: Pickle (.pkl).
- Two-sided behavior: `modelaudit scan evil_savez.pkl` -> **Clean / exit 0** (7/7 checks pass), but
  `pickle.load(open('evil_savez.pkl','rb'))` writes a `.npz` to an attacker-controlled absolute path on load.
- Benign marker: the reduce calls `numpy.savez(<marker_path>, [13.37])` - a harmless array write. No destructive action.
- Root cause: modelaudit's pickle FILE_WRITE call-graph sink table (`_FILE_OPEN_SINK_EXACT`) omits `zipfile.ZipFile`,
  so `numpy.savez`/`savez_compressed` (whose open is mediated by zipfile) evade the detector that catches `numpy.save`.

Files: `evil_savez.pkl` (scan Clean), `build_gadgets.py` (builder). Full report + positive control in the huntr submission.