model-scorecardlisted

# Model Scorecard ## Overview The zero-friction gut check for a public HuggingFace model — the model-side counterpart of a git-repo scorecard. `curl` + `jq` only: no tokens, no accounts, no weight download. It answers one question fast: *what could this model do to me when it loads, and is it even safe to look at closely?* It **never clears** an artifact — a code-bearing model always routes to `model-eval` and a human read. ## Workflow 1. Run: ``` scripts/scorecard.sh <owner/repo or HuggingFace URL> ``` The script reads the public HF API file manifest and `config.json`, detects the weight format and whether the model runs custom code on load, assigns a coarse `(format, loader)` tier, and — for code-bearing models — does a grep-level authority heads-up with an alarm budget. 2. Present the card for a non-technical reader. Translate the tier: - **Tier E** — loads as data only (non-executing weights, no custom code). The low-risk case. Still not a security scan. - **Tier D** — non-executing weights, but runs custom code on load (`trust_remote_code`). A static look cannot clear it → run `model-eval`. - **Tier C** — non-safetensors binary weights. Pickle-family (`.bin/.pt/.pth/.ckpt/.pkl`) executes arbitrary code on load by design; Keras `.h5` can carry code too (custom objects, marshalled Lambda-layer bytecode). Both are hard flags — prefer a safetensors build, and route the actual pickle check to `modelscan` / `p