Pinokio = Virus/Malware Injector

[Coice]

Sorry for the sensationalized title, but how does Pinokio keep your machine from being infected by a bad script that is purposely including malware, but works for its use case?

For example, one of the promoted ("verified") scripts on the homepage, the second in the list, "StyleTTS 2". If you dig into that you see it clones a repo: https://huggingface.co/spaces/Wismut/StyleTTS2_Studio

If you dig more, you'll wind up here: https://huggingface.co/spaces/Wismut/StyleTTS2_Studio/tree/main/Utils/ASR

Inside this folder there is a pickle file that is marked as unsafe by hugging face.

Is there anything that Pinokio does to mitigate this issue? If not, this app is dangerous.

[Norgus]

it would be nice to receive warning if a project is going to use pickles flagged as potentially unsafe by huggingface. Since they do some scans and show this information, perhaps it could be used to place a warning on projects containing such pickles within Pinokio?

https://huggingface.co/docs/hub/en/security-pickle