picklescan
Security scanner detecting Python Pickle files performing suspicious actions
Decision gist · record as of 2026-08-14
Yes. If you work with untrusted or community-sourced pickle files—especially ML models—this tool fills a real security gap with zero installation friction and active maintenance. No dependencies, straightforward CLI, and clear exit codes make it suitable for both manual inspection and automation. Install it.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.11 or later.
- Optional: install numpy to scan .npy files.
- Low friction: pure Python wheel with no runtime dependencies.
License · maintenance · safety
permissive license (permissive) — MIT license permits unrestricted use, modification, and distribution with minimal legal friction.
last release 2026-07-01 (44 days) · last repo commit 2026-07-23 · 418 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 91,871 downloads/mo, #13,497 on PyPI
Alternatives
Verify before relying
pip install picklescan
picklescan --path model.pkl
# or scan from Hugging Face:
picklescan --huggingface username/model-name- Effectiveness of detection heuristics against novel or obfuscated pickle exploits remains unquantified.
- Performance characteristics when scanning very large model files or directories with thousands of files.
What it is and what it does
Picklescan is a command-line security tool that inspects Python Pickle files and related serialized formats (like PyTorch models) to identify dangerous operations before you load them. Pickle's design allows arbitrary code execution during deserialization, making untrusted pickles a significant security risk in machine learning workflows. The scanner reports specific dangerous globals and operations it finds, using exit codes compatible with security scanning tools like ClamAV.
It works with local files, directories, remote URLs, and zip archives (common in PyTorch model distribution). You can filter scans by file patterns and directory traversal rules. The tool has no runtime dependencies and runs as a standalone CLI, making it easy to integrate into CI/CD pipelines or pre-download security checks for models from sources like Hugging Face.
Use it for
- Verify downloaded PyTorch or other ML models from Hugging Face before loading them in your training pipeline.
- Scan model directories in CI/CD to block commits or deployments of pickles with detected dangerous operations.
- Audit local pickle files or model repositories for suspicious code patterns before sharing or using them.
- Integrate into model download workflows to automatically check remote URLs for malicious payloads.
- Screen .npy numpy files alongside pickles when auditing scientific data or model checkpoints.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
If you work with untrusted or community-sourced pickle files—especially ML models—this tool fills a real security gap with zero installation friction and active maintenance. No dependencies, straightforward CLI, and clear exit codes make it suitable for both manual inspection and automation. Install it.
Install
picklescan on PyPI
Before you install
Low friction: pure Python wheel with no runtime dependencies. Active maintenance with a recent release 44 days ago and steady repository activity.
Requires Python 3.11 or later. Optional: install numpy to scan .npy files.
License in practice
MIT license permits unrestricted use, modification, and distribution with minimal legal friction.
Quickstart
pip install picklescan
picklescan --path model.pkl
# or scan from Hugging Face:
picklescan --huggingface username/model-nameVerify before relying
- Effectiveness of detection heuristics against novel or obfuscated pickle exploits remains unquantified.
- Performance characteristics when scanning very large model files or directories with thousands of files.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.11 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 44 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 91,871 / month, #13,497 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: MIT LicenseOperating System :: OS IndependentProgramming Language :: Python :: 3 |
Evidence: picklescan-1.0.5-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “pickle security scanner”
- picklescanScans Python Pickle files and related serialized model formats to…
- ficklingFickling is a decompiler, static analyzer, and bytecode rewriter for…
- pypicklepypickle wraps Python's pickle module to save and load serialized…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also fickling · pypickle · safety · scanoss · cisco-ai-mcp-scanner · dodgy · pdfid · cisco-ai-skill-scanner · guarddog · pyClamd