faces, decals, and prints do not contain code
sounds have the minimal amount of code necessary to load the datablocks, it's a simple matter of opening it up and checking for anything that isn't that
checking for malicious code would generally apply only maybe shady looking weapons or actual scripts from unknowns, which would be a rarity