pickle-sentry 0.2.0__tar.gz

pickle_sentry-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Navid Khan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

pickle_sentry-0.2.0/PKG-INFO

@@ -0,0 +1,146 @@
+Metadata-Version: 2.4
+Name: pickle-sentry
+Version: 0.2.0
+Summary: Scan code and dataset files for unsafe pickle deserialization — including the Hugging Face datasets pandas builder RCE (CVE-2026-57845). Never executes the files it inspects.
+Author: Navid Khan
+License: MIT
+Keywords: security,pickle,deserialization,huggingface,cve-2026-57845,scanner
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# pickle-sentry
+
+Scan code and dataset files for unsafe pickle deserialization — including the
+Hugging Face `datasets` pandas builder RCE, **CVE-2026-57845** (CVSS 8.8).
+
+Pickle is code, not data. Any file, checkpoint, or dataset that passes through
+a pickle loader executes whatever its author put in it. `pickle-sentry` finds
+those paths in your code, and inspects pickle files by *disassembly only* —
+**it never executes the files it inspects** (its test suite proves this with a
+canary payload).
+
+## Why now
+
+CVE-2026-57845 (published 23 Oct 2026): Hugging Face `datasets` through 5.1.0 —
+the latest release — routes `load_dataset("pandas", data_files=...)` to
+`pandas.read_pickle()`. A crafted pickle runs arbitrary Python with the
+victim's privileges the moment the dataset loads. The upstream fix
+(huggingface/datasets#8879) disables the pandas builder, but no patched
+release exists yet. Until one ships, the mitigation is: find every place you
+load pickle-backed data, and migrate to Parquet / CSV / JSON / Arrow.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+Zero dependencies. Python 3.9+.
+
+## Use
+
+```bash
+pickle-sentry scan-path/                     # text report, exit 1 on high+
+pickle-sentry . --format json --output report.json
+pickle-sentry . --format sarif --output report.sarif   # for GitHub code scanning
+pickle-sentry . --fail-on critical           # CI: only fail on critical
+pickle-sentry . --exclude /tests/            # production surface only
+```
+
+### Scan a Hugging Face Hub repo (new in 0.2.0)
+
+```bash
+pickle-sentry hub stanfordnlp/imdb                          # a dataset
+pickle-sentry hub hf-internal-testing/tiny-random-bert --repo-type model
+pickle-sentry hub user/repo --max-size-mb 16 --format json
+```
+
+Lists the repo's files via the Hub API, downloads pickle-family files
+(`.pkl`, `.pickle`, `.joblib`, `.pt`, `.pth`, and classic `pytorch_model.bin`)
+and inspects them by disassembly — including the pickle stream inside torch
+zip archives — and AST-scans any Python files in the repo. Files over the
+size cap are flagged, not downloaded. Set `HF_TOKEN` for private repos.
+Nothing downloaded is ever executed.
+
+## What it catches
+
+**In Python code (AST scan — parses, never imports your code):**
+
+| Rule | Severity | What |
+|---|---|---|
+| `HF-DATASETS-PANDAS-BUILDER` | critical | `load_dataset("pandas", ...)` — CVE-2026-57845 |
+| `UNSAFE-DESERIALIZATION` | high | `pickle.load/loads`, `dill`, `cloudpickle`, `marshal`, `shelve`, `joblib.load` |
+| `PANDAS-READ-PICKLE` | high | `pandas.read_pickle(...)` |
+| `TORCH-LOAD-WEIGHTS-ONLY-FALSE` | high | `torch.load(..., weights_only=False)` |
+| `TORCH-LOAD-NO-WEIGHTS-ONLY` | medium | `torch.load(...)` with no explicit `weights_only=True` |
+| `YAML-UNSAFE-LOAD` | medium | `yaml.load(...)` without a SafeLoader |
+| `NUMPY-ALLOW-PICKLE` | high | `numpy.load(..., allow_pickle=True)` |
+
+**In data files (disassembly via `pickletools`, never unpickled):**
+
+| Rule | Severity | What |
+|---|---|---|
+| `PICKLE-DANGEROUS-REDUCE` | critical | Pickle calls `os.system`, `subprocess.*`, `eval`, `exec`, etc. via `REDUCE` |
+| `PICKLE-REDUCE-CALLABLE` | high | Pickle invokes a non-standard callable via `REDUCE` (the CVE PoC payload's shape) |
+| `PICKLE-DANGEROUS-GLOBAL` / `PICKLE-SUSPICIOUS-MODULE` | high/medium | Dangerous globals referenced without a reduce |
+| `PICKLE-FILE-PRESENT` | medium | Any other `.pkl` / `.pickle` / `.joblib` file, and pickle streams inside torch `.pt`/`.pth` zip archives |
+
+## Real-life use case
+
+[docs/USE-CASE.md](docs/USE-CASE.md) walks through a real one end to end:
+scanning the **actual published CVE-2026-57845 PoC repository** before
+touching it. pickle-sentry flags the vulnerable loader (`run_poc.py:139`,
+critical) and disassembles the live payload (`attacker-controlled.pkl`,
+high) — and the PoC's own `marker.txt` proves the payload never executed
+during the scan.
+
+## Live examples
+
+Scanned two real codebases on 9 Nov 2026 — full results, methodology, and
+honest limits in [docs/LIVE-EXAMPLES.md](docs/LIVE-EXAMPLES.md):
+
+- **huggingface/datasets**: 258 files, 24 findings — and exactly **one** in
+  production source: the CVE sink itself, `pd.read_pickle(f)` at
+  `packaged_modules/pandas/pandas.py:56`.
+- **scikit-learn**: 1,037 files, 73 findings — 16 outside tests, concentrated
+  in `sklearn/datasets/` loaders unpickling cached copies of remotely fetched
+  datasets.
+
+Also included: a composite **GitHub Action** (`action.yml`, use it as
+`uses: Sun-Wukhan/pickle-sentry@main`) and a **pre-commit hook**
+(`.pre-commit-hooks.yaml`). Use `--exclude /tests/` to cut test-fixture noise.
+
+## Demo
+
+```bash
+pickle-sentry examples/vulnerable   # flags the CVE pattern + every sink, exit 1
+pickle-sentry examples/safe         # clean, exit 0
+pickle-sentry examples/hf-datasets-pandas.py
+# ^ the actual upstream datasets pandas builder (verbatim from
+#   huggingface/datasets main): flags pd.read_pickle(f) at line 56 —
+#   the exact sink behind CVE-2026-57845.
+```
+
+## Migrate off pickle
+
+- Datasets: `load_dataset("parquet" | "csv" | "json" | "arrow", ...)`
+- Your own DataFrame: `Dataset.from_pandas(df)` instead of a pickle file
+- DataFrames on disk: `df.to_parquet(...)` / `pd.read_parquet(...)`
+- Torch: `torch.load(path, weights_only=True)`
+
+## Tests
+
+```bash
+pip install pytest
+pytest
+```
+
+The inspector tests build a real malicious pickle (`__reduce__` → `os.system`)
+and assert two things: it is flagged critical, and the payload's canary file
+**never appears** — i.e. inspection did not execute it.
+
+## Licence
+
+MIT

pickle_sentry-0.2.0/README.md

@@ -0,0 +1,134 @@
+# pickle-sentry
+
+Scan code and dataset files for unsafe pickle deserialization — including the
+Hugging Face `datasets` pandas builder RCE, **CVE-2026-57845** (CVSS 8.8).
+
+Pickle is code, not data. Any file, checkpoint, or dataset that passes through
+a pickle loader executes whatever its author put in it. `pickle-sentry` finds
+those paths in your code, and inspects pickle files by *disassembly only* —
+**it never executes the files it inspects** (its test suite proves this with a
+canary payload).
+
+## Why now
+
+CVE-2026-57845 (published 23 Oct 2026): Hugging Face `datasets` through 5.1.0 —
+the latest release — routes `load_dataset("pandas", data_files=...)` to
+`pandas.read_pickle()`. A crafted pickle runs arbitrary Python with the
+victim's privileges the moment the dataset loads. The upstream fix
+(huggingface/datasets#8879) disables the pandas builder, but no patched
+release exists yet. Until one ships, the mitigation is: find every place you
+load pickle-backed data, and migrate to Parquet / CSV / JSON / Arrow.
+
+## Install
+
+```bash
+pip install -e .
+```
+
+Zero dependencies. Python 3.9+.
+
+## Use
+
+```bash
+pickle-sentry scan-path/                     # text report, exit 1 on high+
+pickle-sentry . --format json --output report.json
+pickle-sentry . --format sarif --output report.sarif   # for GitHub code scanning
+pickle-sentry . --fail-on critical           # CI: only fail on critical
+pickle-sentry . --exclude /tests/            # production surface only
+```
+
+### Scan a Hugging Face Hub repo (new in 0.2.0)
+
+```bash
+pickle-sentry hub stanfordnlp/imdb                          # a dataset
+pickle-sentry hub hf-internal-testing/tiny-random-bert --repo-type model
+pickle-sentry hub user/repo --max-size-mb 16 --format json
+```
+
+Lists the repo's files via the Hub API, downloads pickle-family files
+(`.pkl`, `.pickle`, `.joblib`, `.pt`, `.pth`, and classic `pytorch_model.bin`)
+and inspects them by disassembly — including the pickle stream inside torch
+zip archives — and AST-scans any Python files in the repo. Files over the
+size cap are flagged, not downloaded. Set `HF_TOKEN` for private repos.
+Nothing downloaded is ever executed.
+
+## What it catches
+
+**In Python code (AST scan — parses, never imports your code):**
+
+| Rule | Severity | What |
+|---|---|---|
+| `HF-DATASETS-PANDAS-BUILDER` | critical | `load_dataset("pandas", ...)` — CVE-2026-57845 |
+| `UNSAFE-DESERIALIZATION` | high | `pickle.load/loads`, `dill`, `cloudpickle`, `marshal`, `shelve`, `joblib.load` |
+| `PANDAS-READ-PICKLE` | high | `pandas.read_pickle(...)` |
+| `TORCH-LOAD-WEIGHTS-ONLY-FALSE` | high | `torch.load(..., weights_only=False)` |
+| `TORCH-LOAD-NO-WEIGHTS-ONLY` | medium | `torch.load(...)` with no explicit `weights_only=True` |
+| `YAML-UNSAFE-LOAD` | medium | `yaml.load(...)` without a SafeLoader |
+| `NUMPY-ALLOW-PICKLE` | high | `numpy.load(..., allow_pickle=True)` |
+
+**In data files (disassembly via `pickletools`, never unpickled):**
+
+| Rule | Severity | What |
+|---|---|---|
+| `PICKLE-DANGEROUS-REDUCE` | critical | Pickle calls `os.system`, `subprocess.*`, `eval`, `exec`, etc. via `REDUCE` |
+| `PICKLE-REDUCE-CALLABLE` | high | Pickle invokes a non-standard callable via `REDUCE` (the CVE PoC payload's shape) |
+| `PICKLE-DANGEROUS-GLOBAL` / `PICKLE-SUSPICIOUS-MODULE` | high/medium | Dangerous globals referenced without a reduce |
+| `PICKLE-FILE-PRESENT` | medium | Any other `.pkl` / `.pickle` / `.joblib` file, and pickle streams inside torch `.pt`/`.pth` zip archives |
+
+## Real-life use case
+
+[docs/USE-CASE.md](docs/USE-CASE.md) walks through a real one end to end:
+scanning the **actual published CVE-2026-57845 PoC repository** before
+touching it. pickle-sentry flags the vulnerable loader (`run_poc.py:139`,
+critical) and disassembles the live payload (`attacker-controlled.pkl`,
+high) — and the PoC's own `marker.txt` proves the payload never executed
+during the scan.
+
+## Live examples
+
+Scanned two real codebases on 9 Nov 2026 — full results, methodology, and
+honest limits in [docs/LIVE-EXAMPLES.md](docs/LIVE-EXAMPLES.md):
+
+- **huggingface/datasets**: 258 files, 24 findings — and exactly **one** in
+  production source: the CVE sink itself, `pd.read_pickle(f)` at
+  `packaged_modules/pandas/pandas.py:56`.
+- **scikit-learn**: 1,037 files, 73 findings — 16 outside tests, concentrated
+  in `sklearn/datasets/` loaders unpickling cached copies of remotely fetched
+  datasets.
+
+Also included: a composite **GitHub Action** (`action.yml`, use it as
+`uses: Sun-Wukhan/pickle-sentry@main`) and a **pre-commit hook**
+(`.pre-commit-hooks.yaml`). Use `--exclude /tests/` to cut test-fixture noise.
+
+## Demo
+
+```bash
+pickle-sentry examples/vulnerable   # flags the CVE pattern + every sink, exit 1
+pickle-sentry examples/safe         # clean, exit 0
+pickle-sentry examples/hf-datasets-pandas.py
+# ^ the actual upstream datasets pandas builder (verbatim from
+#   huggingface/datasets main): flags pd.read_pickle(f) at line 56 —
+#   the exact sink behind CVE-2026-57845.
+```
+
+## Migrate off pickle
+
+- Datasets: `load_dataset("parquet" | "csv" | "json" | "arrow", ...)`
+- Your own DataFrame: `Dataset.from_pandas(df)` instead of a pickle file
+- DataFrames on disk: `df.to_parquet(...)` / `pd.read_parquet(...)`
+- Torch: `torch.load(path, weights_only=True)`
+
+## Tests
+
+```bash
+pip install pytest
+pytest
+```
+
+The inspector tests build a real malicious pickle (`__reduce__` → `os.system`)
+and assert two things: it is flagged critical, and the payload's canary file
+**never appears** — i.e. inspection did not execute it.
+
+## Licence
+
+MIT

pickle_sentry-0.2.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pickle-sentry"
+version = "0.2.0"
+description = "Scan code and dataset files for unsafe pickle deserialization — including the Hugging Face datasets pandas builder RCE (CVE-2026-57845). Never executes the files it inspects."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Navid Khan" }]
+keywords = ["security", "pickle", "deserialization", "huggingface", "cve-2026-57845", "scanner"]
+dependencies = []
+
+[project.scripts]
+pickle-sentry = "pickle_sentry.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

pickle_sentry-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pickle_sentry-0.2.0/src/pickle_sentry/__init__.py

@@ -0,0 +1,3 @@
+"""pickle-sentry: scan for unsafe pickle deserialization. Never executes inspected files."""
+
+__version__ = "0.2.0"

pickle_sentry-0.2.0/src/pickle_sentry/cli.py

@@ -0,0 +1,102 @@
+from __future__ import annotations
+
+import argparse
+import os
+import sys
+
+from . import __version__
+from .inspector import inspect_file
+from .model import ScanResult
+from .report import to_json, to_sarif, to_text
+from .scanner import scan_python_file
+
+SKIP_DIRS = {".git", "__pycache__", ".venv", "venv", "node_modules", ".tox", ".mypy_cache"}
+PICKLE_EXTS = {".pkl", ".pickle", ".joblib", ".pt", ".pth"}
+
+
+def collect(root: str, exclude: list[str] | None = None) -> ScanResult:
+    exclude = exclude or []
+    result = ScanResult(root=root)
+    paths: list[str] = []
+    if os.path.isfile(root):
+        paths = [root]
+    else:
+        for dirpath, dirnames, filenames in os.walk(root):
+            dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]
+            for name in filenames:
+                paths.append(os.path.join(dirpath, name))
+    if exclude:
+        paths = [p for p in paths if not any(x in p for x in exclude)]
+    for p in sorted(paths):
+        ext = os.path.splitext(p)[1].lower()
+        if ext == ".py":
+            result.files_scanned += 1
+            result.findings.extend(scan_python_file(p))
+        elif ext in PICKLE_EXTS:
+            result.pickle_files_inspected += 1
+            result.findings.extend(inspect_file(p))
+    return result
+
+
+def _hub_main(argv: list[str]) -> int:
+    from .hub import scan_hub_repo
+    ap = argparse.ArgumentParser(
+        prog="pickle-sentry hub",
+        description="Scan a Hugging Face Hub repository for pickle files and unsafe "
+                    "deserialization. Files are inspected by disassembly, never executed.")
+    ap.add_argument("repo_id", help="e.g. user/dataset-name")
+    ap.add_argument("--repo-type", choices=["dataset", "model", "space"], default="dataset")
+    ap.add_argument("--revision", default="main")
+    ap.add_argument("--max-size-mb", type=float, default=64.0,
+                    help="Per-file inspection cap in MB (default: 64)")
+    ap.add_argument("--format", choices=["text", "json", "sarif"], default="text")
+    ap.add_argument("--output", help="Write the report to this file instead of stdout")
+    ap.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "none"],
+                    default="high")
+    args = ap.parse_args(argv)
+    result = scan_hub_repo(args.repo_id, repo_type=args.repo_type, revision=args.revision,
+                           max_bytes=int(args.max_size_mb * 1024 * 1024))
+    rendered = {"text": to_text, "json": to_json, "sarif": to_sarif}[args.format](result)
+    if args.output:
+        with open(args.output, "w", encoding="utf-8") as fh:
+            fh.write(rendered)
+    else:
+        sys.stdout.write(rendered)
+    return 1 if result.meets(args.fail_on) else 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if argv and argv[0] == "hub":
+        return _hub_main(argv[1:])
+    ap = argparse.ArgumentParser(
+        prog="pickle-sentry",
+        description="Scan code and dataset files for unsafe pickle deserialization "
+                    "(incl. CVE-2026-57845). Inspected pickle files are never executed.")
+    ap.add_argument("path", help="File or directory to scan")
+    ap.add_argument("--format", choices=["text", "json", "sarif"], default="text")
+    ap.add_argument("--output", help="Write the report to this file instead of stdout")
+    ap.add_argument("--fail-on", choices=["critical", "high", "medium", "low", "none"],
+                    default="high",
+                    help="Exit 1 if any finding is at or above this severity (default: high)")
+    ap.add_argument("--exclude", action="append", default=[],
+                    help="Skip paths containing this substring (repeatable, e.g. --exclude /tests/)")
+    ap.add_argument("--version", action="version", version=f"pickle-sentry {__version__}")
+    args = ap.parse_args(argv)
+
+    if not os.path.exists(args.path):
+        print(f"error: no such path: {args.path}", file=sys.stderr)
+        return 2
+
+    result = collect(args.path, exclude=args.exclude)
+    rendered = {"text": to_text, "json": to_json, "sarif": to_sarif}[args.format](result)
+    if args.output:
+        with open(args.output, "w", encoding="utf-8") as fh:
+            fh.write(rendered)
+    else:
+        sys.stdout.write(rendered)
+    return 1 if result.meets(args.fail_on) else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

pickle_sentry-0.2.0/src/pickle_sentry/hub.py

@@ -0,0 +1,88 @@
+"""Scan a Hugging Face Hub repository without executing anything in it.
+
+Lists the repo's files via the Hub API, downloads pickle-family files and
+inspects them by disassembly only, and AST-scans any Python files.
+"""
+from __future__ import annotations
+
+import json
+import os
+import urllib.request
+import urllib.error
+
+from .inspector import inspect_pickle_bytes
+from .model import Finding, ScanResult
+from .scanner import scan_python_source
+
+PICKLE_EXTS = {".pkl", ".pickle", ".joblib", ".pt", ".pth"}
+# Model weights in classic PyTorch format are pickle zip archives.
+MODEL_PICKLE_NAMES = {"pytorch_model.bin"}
+DEFAULT_MAX_BYTES = 64 * 1024 * 1024  # per file
+
+
+def _default_fetch(url: str) -> bytes:
+    req = urllib.request.Request(url, headers={"User-Agent": "pickle-sentry/0.2"})
+    token = os.environ.get("HF_TOKEN")
+    if token:
+        req.add_header("Authorization", f"Bearer {token}")
+    with urllib.request.urlopen(req, timeout=60) as resp:
+        return resp.read()
+
+
+def _api_base(repo_type: str) -> str:
+    return {"dataset": "https://huggingface.co/api/datasets/",
+            "model": "https://huggingface.co/api/models/",
+            "space": "https://huggingface.co/api/spaces/"}[repo_type]
+
+
+def _resolve_base(repo_id: str, repo_type: str, revision: str) -> str:
+    prefix = {"dataset": "datasets/", "model": "", "space": "spaces/"}[repo_type]
+    return f"https://huggingface.co/{prefix}{repo_id}/resolve/{revision}/"
+
+
+def scan_hub_repo(repo_id: str, repo_type: str = "dataset", revision: str = "main",
+                  max_bytes: int = DEFAULT_MAX_BYTES, fetch=None) -> ScanResult:
+    fetch = fetch or _default_fetch
+    result = ScanResult(root=f"hub://{repo_type}/{repo_id}@{revision}")
+    try:
+        info = json.loads(fetch(_api_base(repo_type) + repo_id))
+    except (urllib.error.URLError, ValueError) as exc:
+        result.findings.append(Finding("HUB-UNREACHABLE", "low", result.root, None,
+                                       f"Could not read Hub repo info: {exc}"))
+        return result
+
+    siblings = info.get("siblings") or []
+    base = _resolve_base(repo_id, repo_type, revision)
+    for sib in siblings:
+        name = sib.get("rfilename", "")
+        ext = os.path.splitext(name)[1].lower()
+        display = f"{result.root}/{name}"
+        is_pickle = ext in PICKLE_EXTS or os.path.basename(name) in MODEL_PICKLE_NAMES
+        if is_pickle:
+            result.pickle_files_inspected += 1
+            size = sib.get("size")
+            if size is not None and size > max_bytes:
+                result.findings.append(Finding(
+                    "HUB-PICKLE-TOO-LARGE", "high", display, None,
+                    f"Pickle-family file of {size/1e6:.1f} MB exceeds the {max_bytes/1e6:.0f} MB "
+                    "inspection cap and was NOT downloaded. Inspect it locally before trusting it.",
+                    cve="CVE-2026-57845"))
+                continue
+            try:
+                data = fetch(base + urllib.request.quote(name))
+            except urllib.error.URLError as exc:
+                result.findings.append(Finding("HUB-DOWNLOAD-FAILED", "low", display, None,
+                                               f"Could not download for inspection: {exc}"))
+                continue
+            result.findings.extend(inspect_pickle_bytes(data, display))
+        elif ext == ".py":
+            result.files_scanned += 1
+            try:
+                source = fetch(base + urllib.request.quote(name)).decode("utf-8", "replace")
+            except urllib.error.URLError:
+                continue
+            result.findings.extend(scan_python_source(source, display))
+    if not siblings:
+        result.findings.append(Finding("HUB-EMPTY", "info", result.root, None,
+                                       "Hub API returned no files for this repository."))
+    return result