You downloaded a model. Something inside it wants to run instructions you never wrote. Canary reads the file and rules on it — offline, read-only, before you load it.
pip install c4nary
Then canary scan ./model.gguf — or point it at a directory.
A GGUF file carries more than weights. It carries a chat template — a small program that decides how your text is wrapped before the model ever sees it. That template ships inside the model file, runs on your machine, and almost nobody reads it.
A template can be written to inject instructions into every conversation. It can also be written to hide from anyone inspecting it casually. Existing scan suites were built to catch unsafe pickles and executable payloads — not this.
One template in the audit concealed its own payload from plain-text inspection: legible when parsed, invisible when skimmed. It was doing precisely what it was built to do, which was not be noticed.
A security tool that costs money gets pointed at fewer files, and a scanner's whole value is being pointed at everything. Canary is MIT-licensed and stays that way.
If it catches something before you load it, tell someone. That's the entire pricing model.