ai/scikit-learn/SKILL.md
scikit-learn model inspection workflow for loading persisted estimators, pipelines, and tree models. Use when you need to inspect `joblib` or pickle-based model artifacts, view parameters, feature names, importances, or pipeline structure, or run lightweight predictions for analysis.
npx skillsauth add aeondave/malskill scikit-learnInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Use this when the artifact is an estimator, pipeline, or tree model rather than a deep-learning checkpoint.
Use scikit-learn when you need to:
joblib or pickle filesimport joblib
model = joblib.load("model.joblib")
print(type(model))
print(model.get_params().keys())
if hasattr(model, "named_steps"):
print(model.named_steps)
if hasattr(model, "get_feature_names_out"):
print(model.get_feature_names_out())
if hasattr(model, "feature_importances_"):
print(model.feature_importances_)
if hasattr(model, "coef_"):
print(model.coef_)
from sklearn.tree import export_text
if hasattr(model, "tree_"):
print(export_text(model))
joblib is the common persistence format for sklearn models with large NumPy arrays.named_steps early.feature_names_in_ and get_feature_names_out() are high-value clues when reconstructing model inputs.joblib.load and pickle are unsafe for untrusted files.get_params().No bundled scripts/, references/, or assets/.
Use the official scikit-learn persistence and pipeline docs for version and API specifics.
development
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
development
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
development
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
databases
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.