# c4nary

A deterministic, read-only static auditor for GGUF model files that flags chat-template backdoors, SSTI risks, and suspicious tokenizer, config or model-card content without ever rendering templates or loading tensor weights.

c4nary inspects GGUF model files for risk indicators beyond the well-known pickle-deserialization and chat-template SSTI or RCE classes that most model-security tooling already targets. It looks for content-gated instruction injection in chat templates, confusable role tokens in the tokenizer, refusal-suppressing entries in the model configuration, and invisible payloads in the model card, all without rendering any template, executing bundled Python, or reading tensor values; network access is used only in an explicit remote mode.

The project reports running its template rules against a frozen inventory of 192,032 Hugging Face repositories tagged gguf, analyzing 137,698 templates, with 28 repositories producing failing findings and no confirmed false positives in its own review. It explicitly frames its findings as review prompts, not proof that a model is safe or malicious.

Website: https://actualintel.co/