c2pa-metadata — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited c2pa-metadata (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Wraps scripts/embed-c2pa.py to add a C2PA (Coalition for Content Provenance and Authenticity) manifest to any AI-generated marketing asset. The manifest carries a machine-readable provenance trail (who generated it, what generator was used, what prompt produced it, when it was reviewed) plus a visible AI-generation claim in the IPTC digital-source-type vocabulary.
This is the technical mechanism brands use to comply with:
The resulting asset can be inspected by any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, contentcredentials.org/verify).
skills/context-engine/eu-code-of-practice.md for the full Article 50 context.For DMP outputs: embed-c2pa.py now supports --ai-disclosure. Pass it to embed the C2PA 2.4 c2pa.ai-disclosure assertion alongside the existing IPTC digital-source-type claim. The combination gives you both human-readable (IPTC) and machine-readable (c2pa.ai-disclosure) EU AI Act Article 50 signaling — this is the deployer-side machine-readable pathway the final Code of Practice (10 June 2026) points to as the canonical marking mechanism. See skills/context-engine/eu-code-of-practice.md for the full Article 50 context.
/digital-marketing-pro:check for EU-targeted assets# Single asset — image generated by Vertex AI / Nano Banana Pro
/digital-marketing-pro:c2pa-metadata \
--input assets/q3-launch-hero.png \
--output assets/signed/q3-launch-hero.png \
--brand "Acme Corp" \
--generator "Vertex AI / Nano Banana Pro" \
--ai-claim ai-generated-content \
--prompt "minimalist product hero shot, soft natural lighting"
# Video with human review tracked
/digital-marketing-pro:c2pa-metadata \
--input campaigns/launch-video-v3.mp4 \
--output campaigns/signed/launch-video-v3.mp4 \
--brand "Acme Corp" \
--generator "Runway Gen-4" \
--ai-claim ai-generated-content \
--reviewer "Jane Smith"
# EU-targeted asset — add the machine-readable Article 50 AI-disclosure assertion (C2PA 2.4)
/digital-marketing-pro:c2pa-metadata \
--input assets/q3-launch-hero.png \
--output assets/signed/q3-launch-hero.png \
--brand "Acme Corp" \
--generator "Vertex AI / Nano Banana Pro" \
--ai-claim ai-generated-content \
--ai-disclosure \
--prompt "minimalist product hero shot, soft natural lighting"
# Human-created image with AI-assisted edits
/digital-marketing-pro:c2pa-metadata \
--input assets/founder-headshot-edited.jpg \
--output assets/signed/founder-headshot-edited.jpg \
--brand "Acme Corp" \
--generator "Adobe Generative Fill" \
--ai-claim ai-assisted-edits
# Production sign with a real C2PA signing certificate
/digital-marketing-pro:c2pa-metadata \
--input assets/q3-launch-hero.png \
--output assets/signed/q3-launch-hero.png \
--brand "Acme Corp" \
--generator "Vertex AI / Nano Banana Pro" \
--ai-claim ai-generated-content \
--signing-cert /secure/c2pa-prod-cert.pem \
--signing-key /secure/c2pa-prod-key.pem| Value | When to use | Maps to IPTC URI |
|---|---|---|
ai-generated-content | Asset fully generated by AI | algorithmicMedia |
ai-assisted-edits | Human-created + AI-edited (e.g. Generative Fill) | compositeWithTrainedAlgorithmicMedia |
ai-no-substantive-changes | AI used (e.g. upscaling) but no semantic change | minorHumanEdits |
The IPTC vocabulary is what EU AI Act regulators reference — using these values rather than ad-hoc strings makes the asset interoperable with the Article 50 enforcement tooling.
.png · .jpg/.jpeg · .webp · .gif · .tiff · .mp4 · .mov · .webm · .mp3 · .wav · .pdf
Production C2PA signatures require a certificate from a CAI-recognized signing authority. The script will use one if you pass --signing-cert and --signing-key. If you omit them, the script generates a self-signed 90-day dev certificate for development testing only — a self-signed asset will verify as "signature present but signer not in trust list" at contentcredentials.org/verify.
For production deployment:
--signing-cert and --signing-key on every production invocation.Reference: opensource.contentauthenticity.org/docs/manifest/signing-manifests/
c2pa-python==0.38.0: required for signing and for --verifycryptography==46.0.3: only needed for the dev self-signed cert pathThe script never installs anything. If either package is missing it prints the exact python -m pip install "…" command and exits with code 2; show that command to the user and let them decide whether to run it. Do not run pip on their behalf.
Each signature requests a timestamp from http://timestamp.digicert.com (a hash of the claim, not the asset). The dev key, when used, is deleted as soon as the script exits.
The script prints a JSON status report to stdout:
{
"status": "success",
"input": "assets/q3-launch-hero.png",
"output": "assets/signed/q3-launch-hero.png",
"size_bytes": 482371,
"brand": "Acme Corp",
"generator": "Vertex AI / Nano Banana Pro",
"ai_claim": "ai-generated-content",
"created": "2026-05-16T10:30:00+00:00",
"manifest_assertions": ["c2pa.actions", "stds.schema-org.CreativeWork"],
"using_dev_cert": false,
"verify_url": "https://contentcredentials.org/verify"
}In a full 12-part engagement, this skill plugs in at Part 11 — AI Creative Instructions output. After a creative brief is rendered as an actual asset (by your creative tooling or a manual creative process), the resulting file passes through c2pa-metadata before being checked in to engagements/<slug>/11-creative-briefs/signed/.
The /digital-marketing-pro:check pre-publish gate should also verify that all AI-generated assets in an EU-targeted campaign carry a C2PA manifest. v3.4 adds this verification to the EU jurisdiction rule pack in skills/context-engine/compliance-rules.md.
/digital-marketing-pro:check — pre-publish quality gate (now verifies C2PA manifest on AI assets for EU campaigns)skills/context-engine/compliance-rules.md — EU AI Act Article 50 rule packskills/influencer-creator/ftc-compliance.md — FTC endorsement disclosure requirementsc2pa.ai-disclosure assertion (Article 50 machine-readable pathway); Content Credentials 2.3 launch (Feb 2026)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.