pragnyanramtha/joblib-modelscan-poc

Hugging Face PoC for joblib / modelscan

This folder is meant to be uploaded as a Hugging Face model repo PoC for the Huntr joblib target.

What it demonstrates

• model.joblib.gz is a compressed joblib artifact.
• joblib.load("model.joblib.gz") loads a real sklearn Pipeline.
• The load also triggers a safe marker action that creates poc_marker.txt.
• modelscan 0.8.8 skips model.joblib.gz because it keys off the final suffix .gz instead of treating it as a joblib/pickle artifact.
• A directory scan can therefore return clean while scanning only benign.pkl.

Files

• model.joblib.gz: realistic sklearn-shaped PoC artifact
• benign.pkl: benign supported pickle file for directory-scan reproduction
• poc_metadata.json: quick expected-result summary

Reproduction

1. Load with joblib

import joblib
obj = joblib.load("model.joblib.gz")
print(type(obj))

Expected:

• object type is sklearn.pipeline.Pipeline
• poc_marker.txt is created

2. Scan single file with modelscan

modelscan -p model.joblib.gz -r json --show-skipped

Expected:

• total_issues: 0
• errors: []
• total_scanned: 0
• file shown as SCAN_NOT_SUPPORTED

3. Scan whole directory with modelscan

modelscan -p . -r json

Expected:

• exit code 0
• total_issues: 0
• errors: []
• only benign.pkl appears in scanned_files

Safety note

This PoC uses a marker-file side effect only:

• it writes poc_marker.txt
• it does not fetch remote content
• it does not spawn a reverse shell or destructive command