Scan a model or dataset config before you load it
A model file is executable code, not data. This checks a config for load-time code-execution flags (trust_remote_code, custom-code references) and, via the API, checks artifact bytes for known dangerous pickle opcodes. It is a pattern scanner: it does not execute the artifact, and it is bypassable by design, so a clean result means no known dangerous pattern was found, never that the artifact is safe.
This is one honest layer, not a safe-load guarantee. Model-hub scanners are bypassable by design, and the only sure defense against a malicious artifact is to not load untrusted code at all. See where this sits on the coverage matrix.