ml-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/ml-security/SKILL.md. --> # ML Model Security The model and data artifacts: checkpoint formats that execute code on load, provenance for a model you did not train, training-data poisoning and the ingestion controls that bound it, PII that survives into weights, and notebooks that commit their own output. Use when loading a model from disk, a Hub, or object storage, ingesting user content for training or fine-tuning, or writing training, evaluation, or notebook code. ## ALWAYS - Prefer a **tensor-only format** — safetensors — for anything you load. It stores arrays and metadata and has no mechanism for executing code, which is the property that matters. A `.pt`, `.pkl`, `.bin`, `.ckpt` or `joblib` artifact is a pickle: loading it runs whatever the author put in it, before you see a single weight. - Pass `weights_only=True` to `torch.load` **explicitly**, every time. The default has changed across PyTorch releases, so code that relies on it behaves differently depending on the pin — and the flag narrows the surface without removing it, so it is a mitigation rather than a reason to load an untrusted file. `deserialization-security` owns the pickle boundary itself and the per-language detail; `references/artifacts-and-provenance.md` has the format-by-format table. - Establish provenance before loading: the artifact's **hash matches o