DEMOThis report is public and visible to anyone with the link for 30 days, then deleted. Save privately — create free account
malicious-chat-template.gguf
Format: GGUF  ·  Size: 5.3 KB  ·  Scanned: 2026-08-14  ·  3 ms
SHA256: ead8d2ee8bc644b98a1ffb61be7471caadd174f6…

Security grade

F
Score: 0/100
2 CRITICAL 1 HIGH 2 LOW
Artifact Security
F / 0
Repository Trust
N/A
local upload
Deployment Confidence
Low
Artifact Security grades the file. Repository Trust is unavailable for local uploads — no external provenance to verify. Deployment Confidence reflects artifact grade only.
▶ Score breakdown
Base score 100
HIGH Suspicious pattern in KV string value for key 'tokenizer.chat_template' -15
CRITICAL Malicious Jinja2/SSTI pattern in chat template -40
CRITICAL Jinja2 import/from directive in chat template -40
LOW No license field in GGUF metadata (general.license) -3
LOW No embedded provenance metadata -3
Penalty subtotal 0/100
Final F / 0
GGUF v3 model | architecture: llama | quantization: F32 | 9 tensors | 3 blocking issues / 2 warnings

Runtime compatibility

Runtime Status Quant Architecture Context
llama.cpp ✓ ✓ ✓ —
Ollama ✓ ✓ ✓ —
LM Studio ✓ ✓ ✓ —
vLLM ✗ N/A GGUF not supported — requires safetensors format
HuggingFace Transformers ✗ N/A GGUF not directly supported — use safetensors or PyTorch checkpoint

Model info

Architecture
Neural network family — determines which runtime can load this model
llama
Namellmscan-labs-toy
Quantization
Weight storage format derived from actual tensor dtypes; lower bits = smaller file and faster inference at the cost of accuracy
 F32
Parameters ~
Estimated total number of weight values; determines VRAM needed at inference
904
Context length
Maximum tokens the model can process in a single prompt+response; affects KV-cache memory
128 tokens
Embedding dim
Hidden state dimension (d_model); larger = more expressive but more compute per token
8
FFN dim
Feed-forward network intermediate size; typically 2.7–4× embedding_length
16
Layers
Number of transformer blocks (depth); more layers = more reasoning capacity
1
Attention heads (Q)
Number of query heads; GQA/MQA models use fewer KV heads than Q heads
2
KV heads
Key/Value heads per layer; fewer than Q heads = GQA; list = per-layer (hybrid architecture)
 2
Vocab size
Number of unique tokens the tokenizer knows; affects embedding table size
32
Tokenizer
Tokenizer algorithm family (e.g. gpt2 = BPE, llama = SentencePiece)
llama
Chat template
Jinja2 prompt template embedded in model; controls how messages are formatted for inference
✓ Yes — see section below
Tensors
Total number of weight tensors stored in the file
9
File size
Size on disk in megabytes
0.01 MB

Security findings (5)

CRITICAL Metadata Security
Malicious Jinja2/SSTI pattern in chat template
Detected 1 dangerous pattern(s): \{\{[^}]*(os\.system|os\.popen|os\.exec|subprocess|popen\s*\. These are real SSTI vectors (dunder introspection, os/exec access, config/request context leakage) -- not normal template constructs.
→ Reject this model; do not render the template outside a strictly sandboxed environment. Normal constructs (set, for, if, namespace, tojson, tools, tool_calls) are not flagged.
CRITICAL Metadata Security
Jinja2 import/from directive in chat template
import and from directives can load arbitrary Python modules at template render time. This is never needed in a legitimate chat template and is a strong indicator of malicious intent.
→ Reject this model immediately; do not render the template.
HIGH Injection
Suspicious pattern in KV string value for key 'tokenizer.chat_template'
Pattern matched: import\s+os in value: "{% import os %}{{ os.system('id') }}{% for message in messages %}{{ message['content'] }}{% endfor %}"
→ This may indicate a poisoned model attempting code injection; do not use
LOW Supply Chain
No license field in GGUF metadata (general.license)
Absence of license information makes it impossible to determine usage rights
→ Add general.license to model metadata before distributing; use an SPDX identifier
LOW Supply Chain
No embedded provenance metadata
None of general.author, general.source.url, general.base_model.0, or general.source.huggingface.repository are embedded in the GGUF file. Without any origin signal the model cannot be traced to a trusted source or compared against a reference checkpoint for tampering detection. For files uploaded directly, provenance is especially critical because the scanner cannot infer repository origin from the file alone.
→ Add at least one of: general.author, general.source.huggingface.repository, or general.source.url

Integrity & Structure

SHA-256ead8d2ee8bc644b98a1ffb61be7471caadd174f627b9ef52ad89e25fb2ebacb8
SHA-51208a4fc8fcd4744d256b57d8712f64b9f4df1d6379478c98e454d93d22280b066bd8c14090b2cb0bc…
File size (bytes)5,440
Header + KV + tensor directory1,824 bytes (0.00 MB)
Tensor data region3,616 bytes (0.00 MB)
Trailing bytes0
Unaccounted bytes0 ✓
KV metadata keys15
Tensors parsed9
Offsets monotone✓ OK
Max tensor offset3,104

DType Mix

DTypeCountTotal bytesTotal MBAvg bits/elem
F32 9 3,616 0.0 32.0

Chat Template

tokenizer.chat_template (101 chars) — click to collapse 
{% import os %}{{ os.system('id') }}{% for message in messages %}{{ message['content'] }}{% endfor %}

This is a prompt template (non-executable). If your application implements tool-calling agents, enforce a whitelist + schema validation for any <tool_call> output.

Tensor Preview (first 9)

#NameDimsDTypeOffsetBytesbits/elem
0 token_embd.weight [8, 32] F32 0 1,024 32.0
1 output_norm.weight [8] F32 1,024 32 32.0
2 blk.0.attn_q.weight [8, 8] F32 1,056 256 32.0
3 blk.0.attn_k.weight [8, 8] F32 1,312 256 32.0
4 blk.0.attn_v.weight [8, 8] F32 1,568 256 32.0
5 blk.0.attn_output.weight [8, 8] F32 1,824 256 32.0
6 blk.0.ffn_gate.weight [8, 16] F32 2,080 512 32.0
7 blk.0.ffn_down.weight [16, 8] F32 2,592 512 32.0
8 blk.0.ffn_up.weight [8, 16] F32 3,104 512 32.0

Scan coverage

Checks performed
  • ✓Magic bytes &amp; GGUF version validation
  • ✓Header parse (tensor count, KV count)
  • ✓KV metadata parse — all key/value pairs
  • ✓Tensor directory parse (names, dims, dtype, offsets)
  • ✓Tensor offset monotonicity
  • ✓Tensor overlap detection
  • ✓Tensor out-of-bounds detection
  • ✓Data section alignment verification
  • ✓Trailing bytes after last tensor
  • ✓Unaccounted bytes (header vs file size)
  • ✓Dtype histogram &amp; quantization mix analysis
  • ✓Embedding tensor size cross-validation
  • ✓Chat template static scan (Jinja2/SSTI patterns)
  • ✓Runtime compatibility heuristics
  • —External model card / repository context: not available for local upload
  • —Upstream repository: not checked — not available for direct file upload
Not covered
  • ✗Runtime execution or dynamic analysis
  • ✗Behavioral backdoor detection
  • ✗Weight-level semantic backdoor detection
  • ✗Full upstream repository verification
  • ✗License validation beyond embedded metadata
  • ✗Malware scanning of surrounding repo files
  • ✗Adversarial robustness or alignment audit
  • ✗Training data provenance
ⓘ Static scanning can detect structural anomalies and known malicious patterns. It cannot guarantee absence of risk. Treat results as a security signal, not a formal audit.
Raw scan data (.llmscan JSON) 
{
  "compatibility": [
    {
      "arch": true,
      "container": true,
      "context": null,
      "notes": "GGUF v3 container: supported | quant F32: supported",
      "quant": true,
      "runtime": "llama.cpp",
      "supported": true
    },
    {
      "arch": true,
      "container": true,
      "context": null,
      "notes": "GGUF via llama.cpp backend: container and quantization supported",
      "quant": true,
      "runtime": "Ollama",
      "supported": true
    },
    {
      "arch": true,
      "container": true,
      "context": null,
      "notes": "GGUF container and quantization supported; GPU/CPU inference",
      "quant": true,
      "runtime": "LM Studio",
      "supported": true
    },
    {
      "arch": null,
      "container": false,
      "context": null,
      "not_supported_msg": "GGUF not supported \u2014 requires safetensors format",
      "notes": "GGUF not supported; requires safetensors format",
      "quant": false,
      "runtime": "vLLM",
      "supported": false
    },
    {
      "arch": null,
      "container": false,
      "context": null,
      "not_supported_msg": "GGUF not directly supported \u2014 use safetensors or PyTorch checkpoint",
      "notes": "GGUF not supported; requires safetensors or PyTorch checkpoint",
      "quant": false,
      "runtime": "HuggingFace Transformers",
      "supported": false
    }
  ],
  "format": "LLM-SCAN",
  "format_version": "1.0",
  "generator": {
    "name": "llmscan-engine",
    "version": "2.0.0"
  },
  "model": {
    "alignment": 32,
    "arch": "llama",
    "architecture": "llama",
    "basename": null,
    "block_count": 1,
    "bos_token_id": null,
    "chat_template": "{% import os %}{{ os.system(\u0027id\u0027) }}{% for message in messages %}{{ message[\u0027content\u0027] }}{% endfor %}",
    "context_length": 128,
    "dtype_histogram": {
      "F32": 9
    },
    "dtype_percentage": {
      "F32": 100.0
    },
    "dtype_stats": {
      "F32": {
        "avg_bits_per_elem": 32.0,
        "bytes": 3616,
        "count": 9,
        "mb": 0.0
      }
    },
    "embedding_length": 8,
    "eos_token_id": null,
    "feed_forward_length": 16,
    "file_size_bytes": 5440,
    "file_size_mb": 0.01,
    "finetune": null,
    "format": "gguf",
    "gguf_version": 3,
    "has_chat_template": true,
    "head_count": 2,
    "head_count_kv": 2,
    "header_kv_dir_bytes": 1824,
    "kv_count": 15,
    "kv_meta": {
      "keys": [
        "general.architecture",
        "general.file_type",
        "general.name",
        "llama.attention.head_count",
        "llama.attention.head_count_kv",
        "llama.attention.layer_norm_rms_epsilon",
        "llama.block_count",
        "llama.context_length",
        "llama.embedding_length",
        "llama.feed_forward_length",
        "llama.vocab_size",
        "tokenizer.chat_template",
        "tokenizer.ggml.model",
        "tokenizer.ggml.token_type",
        "tokenizer.ggml.tokens"
      ],
      "kv_count": 15,
      "values_redacted": true
    },
    "license": null,
    "max_tensor_offset": 3104,
    "misaligned_tensors": 0,
    "model_name": "llmscan-labs-toy",
    "offsets_monotone": true,
    "oob_tensor_count": 0,
    "overlapping_tensor_pairs": 0,
    "param_estimate": 904,
    "params_estimate": 904,
    "quantization": "F32",
    "scanner_model_info": {
      "alignment": 32,
      "architecture": "llama",
      "basename": null,
      "block_count": 1,
      "bos_token_id": null,
      "chat_template": "{% import os %}{{ os.system(\u0027id\u0027) }}{% for message in messages %}{{ message[\u0027content\u0027] }}{% endfor %}",
      "context_length": 128,
      "data_section_start": 1824,
      "dtype_histogram": {
        "F32": 9
      },
      "dtype_percentage": {
        "F32": 100.0
      },
      "dtype_stats": {
        "F32": {
          "avg_bits_per_elem": 32.0,
          "bytes": 3616,
          "count": 9,
          "mb": 0.0
        }
      },
      "embedding_length": 8,
      "eos_token_id": null,
      "feed_forward_length": 16,
      "file_size_bytes": 5440,
      "file_size_mb": 0.01,
      "finetune": null,
      "has_chat_template": true,
      "head_count": 2,
      "head_count_kv": 2,
      "header_end_offset": 1817,
      "header_kv_dir_bytes": 1824,
      "kv_count": 15,
      "kv_keys": [
        "general.architecture",
        "general.file_type",
        "general.name",
        "llama.attention.head_count",
        "llama.attention.head_count_kv",
        "llama.attention.layer_norm_rms_epsilon",
        "llama.block_count",
        "llama.context_length",
        "llama.embedding_length",
        "llama.feed_forward_length",
        "llama.vocab_size",
        "tokenizer.chat_template",
        "tokenizer.ggml.model",
        "tokenizer.ggml.token_type",
        "tokenizer.ggml.tokens"
      ],
      "license": null,
      "magic": "GGUF",
      "max_tensor_offset": 3104,
      "misaligned_tensors": 0,
      "model_name": "llmscan-labs-toy",
      "offsets_monotone": true,
      "oob_tensor_count": 0,
      "overlapping_tensor_pairs": 0,
      "param_estimate": 904,
      "quantization": "F32",
      "sha256": "ead8d2ee8bc644b98a1ffb61be7471caadd174f627b9ef52ad89e25fb2ebacb8",
      "sha512": "08a4fc8fcd4744d256b57d8712f64b9f4df1d6379478c98e454d93d22280b066bd8c14090b2cb0bc2f5cbad75d795ed852c2ad2b6d2fb36e3dc34b33e62e78f7",
      "size_label": null,
      "tensor_bytes_sum": 3616,
      "tensor_count": 9,
      "tensor_delta_bytes": 1824,
      "tensor_delta_mb": 0.0,
      "tensor_preview": [
        {
          "bits_per_elem": 32.0,
          "byte_len": 1024,
          "dims": [
            8,
            32
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 0,
          "name": "token_embd.weight",
          "offset": 0
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 32,
          "dims": [
            8
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 1,
          "name": "output_norm.weight",
          "offset": 1024
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 2,
          "name": "blk.0.attn_q.weight",
          "offset": 1056
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 3,
          "name": "blk.0.attn_k.weight",
          "offset": 1312
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 4,
          "name": "blk.0.attn_v.weight",
          "offset": 1568
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 5,
          "name": "blk.0.attn_output.weight",
          "offset": 1824
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 512,
          "dims": [
            8,
            16
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 6,
          "name": "blk.0.ffn_gate.weight",
          "offset": 2080
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 512,
          "dims": [
            16,
            8
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 7,
          "name": "blk.0.ffn_down.weight",
          "offset": 2592
        },
        {
          "bits_per_elem": 32.0,
          "byte_len": 512,
          "dims": [
            8,
            16
          ],
          "dtype_id": 0,
          "dtype_name": "F32",
          "index": 8,
          "name": "blk.0.ffn_up.weight",
          "offset": 3104
        }
      ],
      "tokenizer_model": "llama",
      "top_tensors_by_size": [
        {
          "byte_len": 1024,
          "dims": [
            8,
            32
          ],
          "dtype": "F32",
          "n_elem": 256,
          "name": "token_embd.weight"
        },
        {
          "byte_len": 512,
          "dims": [
            8,
            16
          ],
          "dtype": "F32",
          "n_elem": 128,
          "name": "blk.0.ffn_gate.weight"
        },
        {
          "byte_len": 512,
          "dims": [
            16,
            8
          ],
          "dtype": "F32",
          "n_elem": 128,
          "name": "blk.0.ffn_down.weight"
        },
        {
          "byte_len": 512,
          "dims": [
            8,
            16
          ],
          "dtype": "F32",
          "n_elem": 128,
          "name": "blk.0.ffn_up.weight"
        },
        {
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype": "F32",
          "n_elem": 64,
          "name": "blk.0.attn_q.weight"
        },
        {
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype": "F32",
          "n_elem": 64,
          "name": "blk.0.attn_k.weight"
        },
        {
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype": "F32",
          "n_elem": 64,
          "name": "blk.0.attn_v.weight"
        },
        {
          "byte_len": 256,
          "dims": [
            8,
            8
          ],
          "dtype": "F32",
          "n_elem": 64,
          "name": "blk.0.attn_output.weight"
        },
        {
          "byte_len": 32,
          "dims": [
            8
          ],
          "dtype": "F32",
          "n_elem": 8,
          "name": "output_norm.weight"
        }
      ],
      "trailing_bytes": 0,
      "unaccounted_bytes": 0,
      "version": 3,
      "vocab_size": 32
    },
    "sha256": "ead8d2ee8bc644b98a1ffb61be7471caadd174f627b9ef52ad89e25fb2ebacb8",
    "sha512": "08a4fc8fcd4744d256b57d8712f64b9f4df1d6379478c98e454d93d22280b066bd8c14090b2cb0bc2f5cbad75d795ed852c2ad2b6d2fb36e3dc34b33e62e78f7",
    "size_label": null,
    "tensor_bytes_sum": 3616,
    "tensor_count": 9,
    "tensor_delta_bytes": 1824,
    "tensor_delta_mb": 0.0,
    "tensor_preview": [
      {
        "bits_per_elem": 32.0,
        "byte_len": 1024,
        "dims": [
          8,
          32
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 0,
        "name": "token_embd.weight",
        "offset": 0
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 32,
        "dims": [
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 1,
        "name": "output_norm.weight",
        "offset": 1024
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 2,
        "name": "blk.0.attn_q.weight",
        "offset": 1056
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 3,
        "name": "blk.0.attn_k.weight",
        "offset": 1312
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 4,
        "name": "blk.0.attn_v.weight",
        "offset": 1568
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 5,
        "name": "blk.0.attn_output.weight",
        "offset": 1824
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 512,
        "dims": [
          8,
          16
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 6,
        "name": "blk.0.ffn_gate.weight",
        "offset": 2080
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 512,
        "dims": [
          16,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 7,
        "name": "blk.0.ffn_down.weight",
        "offset": 2592
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 512,
        "dims": [
          8,
          16
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 8,
        "name": "blk.0.ffn_up.weight",
        "offset": 3104
      }
    ],
    "tokenizer_model": "llama",
    "top_tensors_by_size": [
      {
        "byte_len": 1024,
        "dims": [
          8,
          32
        ],
        "dtype": "F32",
        "n_elem": 256,
        "name": "token_embd.weight"
      },
      {
        "byte_len": 512,
        "dims": [
          8,
          16
        ],
        "dtype": "F32",
        "n_elem": 128,
        "name": "blk.0.ffn_gate.weight"
      },
      {
        "byte_len": 512,
        "dims": [
          16,
          8
        ],
        "dtype": "F32",
        "n_elem": 128,
        "name": "blk.0.ffn_down.weight"
      },
      {
        "byte_len": 512,
        "dims": [
          8,
          16
        ],
        "dtype": "F32",
        "n_elem": 128,
        "name": "blk.0.ffn_up.weight"
      },
      {
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype": "F32",
        "n_elem": 64,
        "name": "blk.0.attn_q.weight"
      },
      {
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype": "F32",
        "n_elem": 64,
        "name": "blk.0.attn_k.weight"
      },
      {
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype": "F32",
        "n_elem": 64,
        "name": "blk.0.attn_v.weight"
      },
      {
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype": "F32",
        "n_elem": 64,
        "name": "blk.0.attn_output.weight"
      },
      {
        "byte_len": 32,
        "dims": [
          8
        ],
        "dtype": "F32",
        "n_elem": 8,
        "name": "output_norm.weight"
      }
    ],
    "trailing_bytes": 0,
    "unaccounted_bytes": 0,
    "values_redacted": true,
    "vocab_size": 32
  },
  "report": {
    "bullets": [
      "GGUF v3 model | architecture: llama | quantization: F32 | 9 tensors | 3 blocking issues / 2 warnings",
      "Size: 0.01 MB",
      "SHA256: ead8d2ee8bc644b9..."
    ],
    "recommendations": [
      "Reject this model; do not render the template outside a strictly sandboxed environment. Normal constructs (set, for, if, namespace, tojson, tools, tool_calls) are not flagged.",
      "Reject this model immediately; do not render the template.",
      "This may indicate a poisoned model attempting code injection; do not use",
      "Add general.license to model metadata before distributing; use an SPDX identifier",
      "Add at least one of: general.author, general.source.huggingface.repository, or general.source.url"
    ],
    "summary": "GGUF v3 model | architecture: llama | quantization: F32 | 9 tensors | 3 blocking issues / 2 warnings"
  },
  "scan_context": {
    "duration_ms": 3,
    "ended_at": "2026-08-14T22:48:27+00:00Z",
    "limits": {
      "sandbox": true,
      "timeout_ms": 60000
    },
    "mode": "static-deep",
    "started_at": "2026-08-14T22:48:27+00:00Z"
  },
  "security": {
    "findings": [
      {
        "category": "Injection",
        "detail": "Pattern matched: import\\s+os in value: \"{% import os %}{{ os.system(\u0027id\u0027) }}{% for message in messages %}{{ message[\u0027content\u0027] }}{% endfor %}\"",
        "recommendation": "This may indicate a poisoned model attempting code injection; do not use",
        "severity": "HIGH",
        "title": "Suspicious pattern in KV string value for key \u0027tokenizer.chat_template\u0027"
      },
      {
        "category": "Metadata Security",
        "detail": "Detected 1 dangerous pattern(s): \\{\\{[^}]*(os\\.system|os\\.popen|os\\.exec|subprocess|popen\\s*\\. These are real SSTI vectors (dunder introspection, os/exec access, config/request context leakage) -- not normal template constructs.",
        "recommendation": "Reject this model; do not render the template outside a strictly sandboxed environment. Normal constructs (set, for, if, namespace, tojson, tools, tool_calls) are not flagged.",
        "severity": "CRITICAL",
        "title": "Malicious Jinja2/SSTI pattern in chat template"
      },
      {
        "category": "Metadata Security",
        "detail": "import and from directives can load arbitrary Python modules at template render time. This is never needed in a legitimate chat template and is a strong indicator of malicious intent.",
        "recommendation": "Reject this model immediately; do not render the template.",
        "severity": "CRITICAL",
        "title": "Jinja2 import/from directive in chat template"
      },
      {
        "category": "Supply Chain",
        "detail": "Absence of license information makes it impossible to determine usage rights",
        "recommendation": "Add general.license to model metadata before distributing; use an SPDX identifier",
        "severity": "LOW",
        "title": "No license field in GGUF metadata (general.license)"
      },
      {
        "category": "Supply Chain",
        "detail": "None of general.author, general.source.url, general.base_model.0, or general.source.huggingface.repository are embedded in the GGUF file. Without any origin signal the model cannot be traced to a trusted source or compared against a reference checkpoint for tampering detection. For files uploaded directly, provenance is especially critical because the scanner cannot infer repository origin from the file alone.",
        "recommendation": "Add at least one of: general.author, general.source.huggingface.repository, or general.source.url",
        "severity": "LOW",
        "title": "No embedded provenance metadata"
      }
    ],
    "grade": "F",
    "score": 0
  },
  "source": {
    "filename": "malicious-chat-template.gguf",
    "hashes": {
      "sha256": "ead8d2ee8bc644b98a1ffb61be7471caadd174f627b9ef52ad89e25fb2ebacb8"
    },
    "input_type": "file",
    "size_bytes": 5440
  },
  "tensors": {
    "count": 9,
    "dtype_histogram": {
      "F32": 9
    },
    "dtype_stats": {
      "F32": {
        "avg_bits_per_elem": 32.0,
        "bytes": 3616,
        "count": 9,
        "mb": 0.0
      }
    },
    "integrity": {
      "header_kv_dir_bytes": 1824,
      "misaligned_tensors": 0,
      "offsets_monotone": true,
      "oob_tensor_count": 0,
      "overlapping_tensor_pairs": 0,
      "tensor_bytes_sum": 3616,
      "tensor_delta_bytes": 1824,
      "tensor_delta_mb": 0.0,
      "trailing_bytes": 0,
      "unaccounted_bytes": 0
    },
    "preview": [
      {
        "bits_per_elem": 32.0,
        "byte_len": 1024,
        "dims": [
          8,
          32
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 0,
        "name": "token_embd.weight",
        "offset": 0
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 32,
        "dims": [
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 1,
        "name": "output_norm.weight",
        "offset": 1024
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 2,
        "name": "blk.0.attn_q.weight",
        "offset": 1056
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 3,
        "name": "blk.0.attn_k.weight",
        "offset": 1312
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 4,
        "name": "blk.0.attn_v.weight",
        "offset": 1568
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 256,
        "dims": [
          8,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 5,
        "name": "blk.0.attn_output.weight",
        "offset": 1824
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 512,
        "dims": [
          8,
          16
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 6,
        "name": "blk.0.ffn_gate.weight",
        "offset": 2080
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 512,
        "dims": [
          16,
          8
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 7,
        "name": "blk.0.ffn_down.weight",
        "offset": 2592
      },
      {
        "bits_per_elem": 32.0,
        "byte_len": 512,
        "dims": [
          8,
          16
        ],
        "dtype_id": 0,
        "dtype_name": "F32",
        "index": 8,
        "name": "blk.0.ffn_up.weight",
        "offset": 3104
      }
    ]
  },
  "tokenizer": {
    "bos_token_id": null,
    "chat_template_chars": 101,
    "eos_token_id": null,
    "has_chat_template": true,
    "type": "llama",
    "vocab_size": 32
  }
}