# Hugging Face Model Risk Scanner — Free Tool

> Enter a Hugging Face model — get a supply-chain risk read.

URL: [https://playciso.com/tools/model-risk-scanner](https://playciso.com/tools/model-risk-scanner)

The Hugging Face Model Risk Scanner reads a public model’s metadata straight from the Hugging Face API and turns it into a supply-chain risk read. The single biggest factor is whether the model ships custom code that runs on your machine — the trust_remote_code path that CVE-2026-80047 showed can plant files before you ever consent — alongside its license, how widely adopted it is, how new it is, and whether it is gated.

It is the fast "should I pull this model?" check to run before a model enters your product and your AIBOM.

## How to use it

- Enter a Hugging Face model id (for example: meta-llama/Llama-3-8B or sentence-transformers/all-MiniLM-L6-v2).
- Read the risk band and the factors behind it — custom code, license, downloads, age and gating.
- If it clears, add it to your AIBOM; if it ships custom code, treat it like running an unknown binary.

## FAQ

### What makes a Hugging Face model risky?

The highest-signal factor is custom/remote code (trust_remote_code): models that ship .py files which execute in your environment. After that: a missing or non-commercial license, very low adoption, a very recent upload with no track record, and gating. This tool surfaces all of them from the model’s own metadata.

### Why does custom code matter so much?

Loading a model with custom code runs that code on your machine. Hugging Face Transformers CVE-2026-80047 showed the trust-remote-code path could even write attacker files to disk before the consent prompt. Treat a custom-code model like an unknown binary.

### Does the scanner need my Hugging Face token?

No. It reads public model metadata only. Private or gated model details are limited to what the public API returns.


---

PlayCISO is a simulation-first platform for security leaders: a War Room incident simulator, a simulated PCI DSS QSA interview, board-report coaching, free security scanners, and a curated library of free courses. https://playciso.com