How downloads are checked

Every zip is checked before it goes up. The result sits under its Download button.

What’s inside
Skins and sounds hold only .vpk game files, and each one has to carry a real VPK header. No archives inside archives, no encrypted files, no programs. SwapLock is the one program here, and its source code is a separate download.
Malware scan
Microsoft Defender scans the whole zip, files inside included, with that day’s signatures. Each download lists the engine and signature versions used.
Fingerprint
The SHA-256 under each download belongs to the exact file that was scanned. If a zip changes, its result comes down until it’s scanned again.
Check it yourself
In PowerShell, run Get-FileHash .\Bowser_over_Rat_King.zip and compare the hash with the one on the mod page.

“No malware detected” means no known malware was found. It isn’t a promise that a file is harmless.