---
id: picklescan
version: "1.0.5"
license: unclear
license_treatment: permissive
maintenance: active
---

# picklescan — Security scanner detecting Python Pickle files performing suspicious actions

License: permissive · Maintenance: active · Downloads: 91.9K/mo

## What it is and what it does

Picklescan is a command-line security tool that inspects Python Pickle files and related serialized formats (like PyTorch models) to identify dangerous operations before you load them. Pickle's design allows arbitrary code execution during deserialization, making untrusted pickles a significant security risk in machine learning workflows. The scanner reports specific dangerous globals and operations it finds, using exit codes compatible with security scanning tools like ClamAV.

It works with local files, directories, remote URLs, and zip archives (common in PyTorch model distribution). You can filter scans by file patterns and directory traversal rules. The tool has no runtime dependencies and runs as a standalone CLI, making it easy to integrate into CI/CD pipelines or pre-download security checks for models from sources like Hugging Face.

Use it for:

- Verify downloaded PyTorch or other ML models from Hugging Face before loading them in your training pipeline.
- Scan model directories in CI/CD to block commits or deployments of pickles with detected dangerous operations.
- Audit local pickle files or model repositories for suspicious code patterns before sharing or using them.
- Integrate into model download workflows to automatically check remote URLs for malicious payloads.
- Screen .npy numpy files alongside pickles when auditing scientific data or model checkpoints.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Scans Python Pickle files and related serialized model formats to detect suspicious or malicious code execution patterns before loading them.

Yes. If you work with untrusted or community-sourced pickle files—especially ML models—this tool fills a real security gap with zero installation friction and active maintenance. No dependencies, straightforward CLI, and clear exit codes make it suitable for both manual inspection and automation. Install it.

## Install

pip install picklescan
uv add picklescan
poetry add picklescan

## Installing picklescan

Before you install: Low friction: pure Python wheel with no runtime dependencies. Active maintenance with a recent release 44 days ago and steady repository activity.

License in practice: MIT license permits unrestricted use, modification, and distribution with minimal legal friction.

Quickstart:

pip install picklescan
picklescan --path model.pkl
# or scan from Hugging Face:
picklescan --huggingface username/model-name

Requires Python 3.11 or later. Optional: install numpy to scan .npy files.

Verify before relying:

- Effectiveness of detection heuristics against novel or obfuscated pickle exploits remains unquantified.
- Performance characteristics when scanning very large model files or directories with thousands of files.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 91.9K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

pickle security scanner, detect malicious pickle files, python pickle vulnerability detection, model file safety checker, pytorch model security scan, malware-detection, machine-learning-security, cli-tool

[View on SkillFed](https://skillfed.io/packages/picklescan) · [View on PyPI](https://pypi.org/project/picklescan/)