[Mr.Silence]

Unfortunately, this is not possible to do with SMAC.

Essentially, SMAC is a server-side plugin that acts/reacts to things on the server end. This means that it can do something about things going on in the server itself, which includes information being sent to the server by clients. So, something like rcon login attempts or cvar changes/info being sent to the server by a user can be monitored and reacted to, especially when these things are not desired or seem malicious in nature.

However, SMAC is only able to take action on what is being sent to/from the server. It cannot interact with a user's game client/files on their computer directly, which means something like scanning or opening .vpk files to check their legitimacy is not possible for the plugin to do. For this to be possible for SMAC, it would require the game client reporting this information to the server or the use of a third party client-side application to run alongside the game on the user's end to report this information to the server.

The best that can be done to mitigate this issue is setting the server to sv_pure 1 and setting up a whitelist for files/mods you approve of. While that may not be what you are looking for, its about the only way to deal with the issue, unfortunately.