Creator · indranilbanerjee
Last updated · Sep 2, 2026
Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion fo
Creator · indranilbanerjee
Last updated · Sep 2, 2026
Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion fo
Creator · indranilbanerjee
Last updated · Sep 2, 2026
Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion fo
Creator · indranilbanerjee
Last updated · Sep 2, 2026
Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion fo
Sandbox only
Install targets
Codex install prompt
Install the "c2pa-metadata" agent skill from https://github.com/indranilbanerjee/digital-marketing-pro/tree/main/skills/c2pa-metadata. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"indranilbanerjee-c2pa-metadata","task":"Install c2pa-metadata","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
GitHub automation
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Maintenance
fresh
21d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
787
76/100 Quality · 75/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
787 GitHub stars
Repo activity
787 stars, 132 forks
Maintenance
21d since push
License
MIT
Install
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
Agent should check
Copy prompt
Task: Use c2pa-metadata in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install
Install command: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
LLM text format
/api/skills/indranilbanerjee-c2pa-metadata/install?format=text
Find alternatives
/api/skills/search?q=c2pa-metadata&limit=3
Agent prompt
Use c2pa-metadata for this task. Review https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install, then install with: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/indranilbanerjee-c2pa-metadata
LLM text
/api/registry/manifest/indranilbanerjee-c2pa-metadata?format=text
Install alias
/api/registry/install/indranilbanerjee-c2pa-metadata
Recommend
/api/registry/recommend?task=Use%20c2pa-metadata%20in%20an%20agent%20workflow&limit=3
Agent fit
GitHub automation
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
GitHub automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO787 GitHub stars
Stars/forks activity
INFO787 stars, 132 forks; issue activity unavailable in current metadata
Recent maintenance
PASS21d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Manage repositories
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Process rich media
I need my agent to process images, video, or audio and extract useful information.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: c2pa-metadata description: "Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish." ---
# /digital-marketing-pro:c2pa-metadata — Embed Content Authenticity Provenance
## Purpose
Wraps `scripts/embed-c2pa.py` to add a **C2PA (Coalition for Content Provenance and Authenticity) manifest** to any AI-generated marketing asset. The manifest carries a machine-readable provenance trail (who generated it, what generator was used, what prompt produced it, when it was reviewed) plus a visible AI-generation claim in the IPTC digital-source-type vocabulary.
This is the technical mechanism brands use to comply with:
- **EU AI Act Article 50** (applicable 2 August 2026) — generative-AI marketing content must be marked in a machine-readable format using open, interoperable standards. C2PA is the emerging backbone. Penalty for non-compliance: up to **€15 million or 3% global annual turnover**. - **NY synthetic-performer disclosure law** (effective June 2026) — $1K–$5K per violation, $10K repeat; applies to synthetic influencers and AI-generated endorsements. - **FTC May 2026 endorsement guidance** — covers AI testimonials and synthetic creator content. - **Australia Online Safety Act / UK Online Safety Act** — emerging deepfake disclosure requirements.
The resulting asset can be inspected by any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, [contentcredentials.org/verify](https://contentcredentials.org/verify)).
### C2PA spec versions to be aware of (June 2026)
- **Content Credentials 2.3** (released 9 February 2026 — [launch post](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/)) added format support for: **live video** (broadcast/streaming), **plain text documents**, **OGG Vorbis audio**, **large AVI video files**, and **EXIF Original Preservation Images**. If a brand is signing live-stream video or text-based assets for the first time, 2.3 is the floor version to target. - **C2PA Spec 2.4** (April 2026 — [spec.c2pa.org/specifications/specifications/2.4](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html)) introduces the **AI Disclosure Assertion (`c2pa.ai-disclosure`)** for machine-readable AI transparency info — this is the assertion the EU AI Act Article 50 deployer pathway will rely on. The final Code of Practice on Transparency of AI-Generated Content (published 10 June 2026) references C2PA-style assertions as the canonical machine-readable marking mechanism for both providers and deployers. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context. - The **C2PA Trust List** is now handled via the public C2PA Conformance Program (any CA meeting the Certificate Policy can join). Production signing certificates should come from a Conformance-Program-listed CA, not an ad-hoc cert.
**For DMP outputs**: `embed-c2pa.py` now supports `--ai-disclosure`. Pass it to embed the C2PA 2.4 `c2pa.ai-disclosure` assertion alongside the existing IPTC digital-source-type claim. The combination gives you both human-readable (IPTC) and machine-readable (`c2pa.ai-disclosure`) EU AI Act **Article 50** signaling — this is the deployer-side machine-readable pathway the final Code of Practice (10 June 2026) points to as the canonical marking mechanism. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context.
## When to invoke
- Right after any AI image / video / audio generation step in the engagement workflow (Part 11 — AI Creative Instructions output) - Before handing a generated asset to the design team for review - As a pre-publish gate in `/digital-marketing-pro:check` for EU-targeted assets - Bulk-applying to a backlog of AI-generated assets before EU AI Act enforcement on 2 Aug 2026
## Quick examples
```bash # Single asset — image generated by Vertex AI / Nano Banana Pro /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --prompt "minimalist product hero shot, soft natural lighting"
# Video with human review tracked /digital-marketing-pro:c2pa-metadata \ --input campaigns/launch-video-v3.mp4 \ --output campaigns/signed/launch-video-v3.mp4 \ --brand "Acme Corp" \ --generator "Runway Gen-4" \ --ai-claim ai-generated-content \ --reviewer "Jane Smith"
# EU-targeted asset — add the machine-readable Article 50 AI-disclosure assertion (C2PA 2.4) /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --ai-disclosure \ --prompt "minimalist product hero shot, soft natural lighting"
# Human-created image with AI-assisted edits /digital-marketing-pro:c2pa-metadata \ --input assets/founder-headshot-edited.jpg \ --output assets/signed/founder-headshot-edited.jpg \ --brand "Acme Corp" \ --generator "Adobe Generative Fill" \ --ai-claim ai-assisted-edits
# Production sign with a real C2PA signing certificate /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --signing-cert /secure/c2pa-prod-cert.pem \ --signing-key /secure/c2pa-prod-key.pem ```
## AI claim values (IPTC digital source type)
| Value | When to use | Maps to IPTC URI | |---|---|---| | `ai-generated-content` | Asset fully generated by AI | `algorithmicMedia` | | `ai-assisted-edits` | Human-created + AI-edited (e.g. Generative Fill) | `compositeWithTrainedAlgorithmicMedia` | | `ai-no-substantive-changes` | AI used (e.g. upscaling) but no semantic change | `minorHumanEdits` |
The IPTC vocabulary is what EU AI Act regulators reference — using these values rather than ad-hoc strings makes the asset interoperable with the Article 50 enforcement tooling.
## Supported asset formats
`.png` · `.jpg/.jpeg` · `.webp` · `.gif` · `.tiff` · `.mp4` · `.mov` · `.webm` · `.mp3` · `.wav` · `.pdf`
## Signing certificate
Production C2PA signatures require a certificate from a CAI-recognized signing authority. The script will use one if you pass `--signing-cert` and `--signing-key`. If you omit them, the script generates a **self-signed 90-day dev certificate** for development testing only — a self-signed asset will verify as "signature present but signer not in trust list" at [contentcredentials.org/verify](https://contentcredentials.org/verify).
For production deployment:
1. Obtain a C2PA-compatible signing certificate from a CAI-recognized authority (Adobe, Truepic, Numbers Protocol, Microsoft Azure Confidential Ledger). 2. Store the cert + key securely (do NOT commit to git; use an environment-variable path or secret store). 3. Pass `--signing-cert` and `--signing-key` on every production invocation.
Reference: [opensource.contentauthenticity.org/docs/manifest/signing-manifests/](https://opensource.contentauthenticity.org/docs/manifest/signing-manifests/)
## Python dependencies
- `c2pa-python>=0.5.0` — auto-installed on first run via `pip install` - `cryptography` — only needed for the dev self-signed cert path; auto-installed if missing
Both are part of the plugin's **Full mode** (~50 MB) — see `pip install -r scripts/requirements.txt` in the README.
## Output
The script prints a JSON status report to stdout:
```json { "status": "success", "input": "assets/q3-launch-hero.png", "output": "assets/signed/q3-launch-hero.png", "size_bytes": 482371, "brand": "Acme Corp", "generator": "Vertex AI / Nano Banana Pro", "ai_claim": "ai-generated-content", "created": "2026-05-16T10:30:00+00:00", "manifest_assertions": ["c2pa.actions", "stds.schema-org.CreativeWork"], "using_dev_cert": false, "verify_url": "https://contentcredentials.org/verify" } ```
## Integration with the engagement workflow
In a full 12-part engagement, this skill plugs in at **Part 11 — AI Creative Instructions output**. After a creative brief is rendered as an actual asset (by your creative tooling or a manual creative process), the resulting file passes through `c2pa-metadata` before being checked in to `engagements/<slug>/11-creative-briefs/signed/`.
The `/digital-marketing-pro:check` pre-publish gate should also verify that all AI-generated assets in an EU-targeted campaign carry a C2PA manifest. v3.4 adds this verification to the EU jurisdiction rule pack in `skills/context-engine/compliance-rules.md`.
## Related
- `/digital-marketing-pro:check` — pre-publish quality gate (now verifies C2PA manifest on AI assets for EU campaigns) - `skills/context-engine/compliance-rules.md` — EU AI Act Article 50 rule pack - `skills/influencer-creator/ftc-compliance.md` — FTC endorsement disclosure requirements - [C2PA Specification 2.4 (April 2026)](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html) — defines the `c2pa.ai-disclosure` assertion (Article 50 machine-readable pathway); [Content Credentials 2.3 launch (Feb 2026)](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/) - [Content Authenticity Initiative](https://contentauthenticity.org/)
Source provenance
Decision snapshot
787 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for c2pa-metadata, ready for a manual X post.
c2pa-metadata: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, T... 787 stars https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x
Listing + install path for c2pa-metadata: https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x Install: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to indranilbanerjee but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata/audit)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)indranilbanerjee
@indranilbanerjee
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "c2pa-metadata" agent skill from https://github.com/indranilbanerjee/digital-marketing-pro/tree/main/skills/c2pa-metadata. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"indranilbanerjee-c2pa-metadata","task":"Install c2pa-metadata","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
GitHub automation
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Maintenance
fresh
21d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
787
76/100 Quality · 75/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
787 GitHub stars
Repo activity
787 stars, 132 forks
Maintenance
21d since push
License
MIT
Install
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
Agent should check
Copy prompt
Task: Use c2pa-metadata in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install
Install command: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
LLM text format
/api/skills/indranilbanerjee-c2pa-metadata/install?format=text
Find alternatives
/api/skills/search?q=c2pa-metadata&limit=3
Agent prompt
Use c2pa-metadata for this task. Review https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install, then install with: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/indranilbanerjee-c2pa-metadata
LLM text
/api/registry/manifest/indranilbanerjee-c2pa-metadata?format=text
Install alias
/api/registry/install/indranilbanerjee-c2pa-metadata
Recommend
/api/registry/recommend?task=Use%20c2pa-metadata%20in%20an%20agent%20workflow&limit=3
Agent fit
GitHub automation
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
GitHub automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO787 GitHub stars
Stars/forks activity
INFO787 stars, 132 forks; issue activity unavailable in current metadata
Recent maintenance
PASS21d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Manage repositories
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Process rich media
I need my agent to process images, video, or audio and extract useful information.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: c2pa-metadata description: "Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish." ---
# /digital-marketing-pro:c2pa-metadata — Embed Content Authenticity Provenance
## Purpose
Wraps `scripts/embed-c2pa.py` to add a **C2PA (Coalition for Content Provenance and Authenticity) manifest** to any AI-generated marketing asset. The manifest carries a machine-readable provenance trail (who generated it, what generator was used, what prompt produced it, when it was reviewed) plus a visible AI-generation claim in the IPTC digital-source-type vocabulary.
This is the technical mechanism brands use to comply with:
- **EU AI Act Article 50** (applicable 2 August 2026) — generative-AI marketing content must be marked in a machine-readable format using open, interoperable standards. C2PA is the emerging backbone. Penalty for non-compliance: up to **€15 million or 3% global annual turnover**. - **NY synthetic-performer disclosure law** (effective June 2026) — $1K–$5K per violation, $10K repeat; applies to synthetic influencers and AI-generated endorsements. - **FTC May 2026 endorsement guidance** — covers AI testimonials and synthetic creator content. - **Australia Online Safety Act / UK Online Safety Act** — emerging deepfake disclosure requirements.
The resulting asset can be inspected by any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, [contentcredentials.org/verify](https://contentcredentials.org/verify)).
### C2PA spec versions to be aware of (June 2026)
- **Content Credentials 2.3** (released 9 February 2026 — [launch post](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/)) added format support for: **live video** (broadcast/streaming), **plain text documents**, **OGG Vorbis audio**, **large AVI video files**, and **EXIF Original Preservation Images**. If a brand is signing live-stream video or text-based assets for the first time, 2.3 is the floor version to target. - **C2PA Spec 2.4** (April 2026 — [spec.c2pa.org/specifications/specifications/2.4](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html)) introduces the **AI Disclosure Assertion (`c2pa.ai-disclosure`)** for machine-readable AI transparency info — this is the assertion the EU AI Act Article 50 deployer pathway will rely on. The final Code of Practice on Transparency of AI-Generated Content (published 10 June 2026) references C2PA-style assertions as the canonical machine-readable marking mechanism for both providers and deployers. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context. - The **C2PA Trust List** is now handled via the public C2PA Conformance Program (any CA meeting the Certificate Policy can join). Production signing certificates should come from a Conformance-Program-listed CA, not an ad-hoc cert.
**For DMP outputs**: `embed-c2pa.py` now supports `--ai-disclosure`. Pass it to embed the C2PA 2.4 `c2pa.ai-disclosure` assertion alongside the existing IPTC digital-source-type claim. The combination gives you both human-readable (IPTC) and machine-readable (`c2pa.ai-disclosure`) EU AI Act **Article 50** signaling — this is the deployer-side machine-readable pathway the final Code of Practice (10 June 2026) points to as the canonical marking mechanism. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context.
## When to invoke
- Right after any AI image / video / audio generation step in the engagement workflow (Part 11 — AI Creative Instructions output) - Before handing a generated asset to the design team for review - As a pre-publish gate in `/digital-marketing-pro:check` for EU-targeted assets - Bulk-applying to a backlog of AI-generated assets before EU AI Act enforcement on 2 Aug 2026
## Quick examples
```bash # Single asset — image generated by Vertex AI / Nano Banana Pro /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --prompt "minimalist product hero shot, soft natural lighting"
# Video with human review tracked /digital-marketing-pro:c2pa-metadata \ --input campaigns/launch-video-v3.mp4 \ --output campaigns/signed/launch-video-v3.mp4 \ --brand "Acme Corp" \ --generator "Runway Gen-4" \ --ai-claim ai-generated-content \ --reviewer "Jane Smith"
# EU-targeted asset — add the machine-readable Article 50 AI-disclosure assertion (C2PA 2.4) /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --ai-disclosure \ --prompt "minimalist product hero shot, soft natural lighting"
# Human-created image with AI-assisted edits /digital-marketing-pro:c2pa-metadata \ --input assets/founder-headshot-edited.jpg \ --output assets/signed/founder-headshot-edited.jpg \ --brand "Acme Corp" \ --generator "Adobe Generative Fill" \ --ai-claim ai-assisted-edits
# Production sign with a real C2PA signing certificate /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --signing-cert /secure/c2pa-prod-cert.pem \ --signing-key /secure/c2pa-prod-key.pem ```
## AI claim values (IPTC digital source type)
| Value | When to use | Maps to IPTC URI | |---|---|---| | `ai-generated-content` | Asset fully generated by AI | `algorithmicMedia` | | `ai-assisted-edits` | Human-created + AI-edited (e.g. Generative Fill) | `compositeWithTrainedAlgorithmicMedia` | | `ai-no-substantive-changes` | AI used (e.g. upscaling) but no semantic change | `minorHumanEdits` |
The IPTC vocabulary is what EU AI Act regulators reference — using these values rather than ad-hoc strings makes the asset interoperable with the Article 50 enforcement tooling.
## Supported asset formats
`.png` · `.jpg/.jpeg` · `.webp` · `.gif` · `.tiff` · `.mp4` · `.mov` · `.webm` · `.mp3` · `.wav` · `.pdf`
## Signing certificate
Production C2PA signatures require a certificate from a CAI-recognized signing authority. The script will use one if you pass `--signing-cert` and `--signing-key`. If you omit them, the script generates a **self-signed 90-day dev certificate** for development testing only — a self-signed asset will verify as "signature present but signer not in trust list" at [contentcredentials.org/verify](https://contentcredentials.org/verify).
For production deployment:
1. Obtain a C2PA-compatible signing certificate from a CAI-recognized authority (Adobe, Truepic, Numbers Protocol, Microsoft Azure Confidential Ledger). 2. Store the cert + key securely (do NOT commit to git; use an environment-variable path or secret store). 3. Pass `--signing-cert` and `--signing-key` on every production invocation.
Reference: [opensource.contentauthenticity.org/docs/manifest/signing-manifests/](https://opensource.contentauthenticity.org/docs/manifest/signing-manifests/)
## Python dependencies
- `c2pa-python>=0.5.0` — auto-installed on first run via `pip install` - `cryptography` — only needed for the dev self-signed cert path; auto-installed if missing
Both are part of the plugin's **Full mode** (~50 MB) — see `pip install -r scripts/requirements.txt` in the README.
## Output
The script prints a JSON status report to stdout:
```json { "status": "success", "input": "assets/q3-launch-hero.png", "output": "assets/signed/q3-launch-hero.png", "size_bytes": 482371, "brand": "Acme Corp", "generator": "Vertex AI / Nano Banana Pro", "ai_claim": "ai-generated-content", "created": "2026-05-16T10:30:00+00:00", "manifest_assertions": ["c2pa.actions", "stds.schema-org.CreativeWork"], "using_dev_cert": false, "verify_url": "https://contentcredentials.org/verify" } ```
## Integration with the engagement workflow
In a full 12-part engagement, this skill plugs in at **Part 11 — AI Creative Instructions output**. After a creative brief is rendered as an actual asset (by your creative tooling or a manual creative process), the resulting file passes through `c2pa-metadata` before being checked in to `engagements/<slug>/11-creative-briefs/signed/`.
The `/digital-marketing-pro:check` pre-publish gate should also verify that all AI-generated assets in an EU-targeted campaign carry a C2PA manifest. v3.4 adds this verification to the EU jurisdiction rule pack in `skills/context-engine/compliance-rules.md`.
## Related
- `/digital-marketing-pro:check` — pre-publish quality gate (now verifies C2PA manifest on AI assets for EU campaigns) - `skills/context-engine/compliance-rules.md` — EU AI Act Article 50 rule pack - `skills/influencer-creator/ftc-compliance.md` — FTC endorsement disclosure requirements - [C2PA Specification 2.4 (April 2026)](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html) — defines the `c2pa.ai-disclosure` assertion (Article 50 machine-readable pathway); [Content Credentials 2.3 launch (Feb 2026)](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/) - [Content Authenticity Initiative](https://contentauthenticity.org/)
Source provenance
Decision snapshot
787 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for c2pa-metadata, ready for a manual X post.
c2pa-metadata: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, T... 787 stars https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x
Listing + install path for c2pa-metadata: https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x Install: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to indranilbanerjee but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata/audit)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)indranilbanerjee
@indranilbanerjee
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "c2pa-metadata" agent skill from https://github.com/indranilbanerjee/digital-marketing-pro/tree/main/skills/c2pa-metadata. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"indranilbanerjee-c2pa-metadata","task":"Install c2pa-metadata","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
GitHub automation
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Maintenance
fresh
21d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
787
76/100 Quality · 75/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
787 GitHub stars
Repo activity
787 stars, 132 forks
Maintenance
21d since push
License
MIT
Install
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
Agent should check
Copy prompt
Task: Use c2pa-metadata in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install
Install command: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
LLM text format
/api/skills/indranilbanerjee-c2pa-metadata/install?format=text
Find alternatives
/api/skills/search?q=c2pa-metadata&limit=3
Agent prompt
Use c2pa-metadata for this task. Review https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install, then install with: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/indranilbanerjee-c2pa-metadata
LLM text
/api/registry/manifest/indranilbanerjee-c2pa-metadata?format=text
Install alias
/api/registry/install/indranilbanerjee-c2pa-metadata
Recommend
/api/registry/recommend?task=Use%20c2pa-metadata%20in%20an%20agent%20workflow&limit=3
Agent fit
GitHub automation
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
GitHub automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO787 GitHub stars
Stars/forks activity
INFO787 stars, 132 forks; issue activity unavailable in current metadata
Recent maintenance
PASS21d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Manage repositories
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Process rich media
I need my agent to process images, video, or audio and extract useful information.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: c2pa-metadata description: "Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish." ---
# /digital-marketing-pro:c2pa-metadata — Embed Content Authenticity Provenance
## Purpose
Wraps `scripts/embed-c2pa.py` to add a **C2PA (Coalition for Content Provenance and Authenticity) manifest** to any AI-generated marketing asset. The manifest carries a machine-readable provenance trail (who generated it, what generator was used, what prompt produced it, when it was reviewed) plus a visible AI-generation claim in the IPTC digital-source-type vocabulary.
This is the technical mechanism brands use to comply with:
- **EU AI Act Article 50** (applicable 2 August 2026) — generative-AI marketing content must be marked in a machine-readable format using open, interoperable standards. C2PA is the emerging backbone. Penalty for non-compliance: up to **€15 million or 3% global annual turnover**. - **NY synthetic-performer disclosure law** (effective June 2026) — $1K–$5K per violation, $10K repeat; applies to synthetic influencers and AI-generated endorsements. - **FTC May 2026 endorsement guidance** — covers AI testimonials and synthetic creator content. - **Australia Online Safety Act / UK Online Safety Act** — emerging deepfake disclosure requirements.
The resulting asset can be inspected by any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, [contentcredentials.org/verify](https://contentcredentials.org/verify)).
### C2PA spec versions to be aware of (June 2026)
- **Content Credentials 2.3** (released 9 February 2026 — [launch post](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/)) added format support for: **live video** (broadcast/streaming), **plain text documents**, **OGG Vorbis audio**, **large AVI video files**, and **EXIF Original Preservation Images**. If a brand is signing live-stream video or text-based assets for the first time, 2.3 is the floor version to target. - **C2PA Spec 2.4** (April 2026 — [spec.c2pa.org/specifications/specifications/2.4](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html)) introduces the **AI Disclosure Assertion (`c2pa.ai-disclosure`)** for machine-readable AI transparency info — this is the assertion the EU AI Act Article 50 deployer pathway will rely on. The final Code of Practice on Transparency of AI-Generated Content (published 10 June 2026) references C2PA-style assertions as the canonical machine-readable marking mechanism for both providers and deployers. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context. - The **C2PA Trust List** is now handled via the public C2PA Conformance Program (any CA meeting the Certificate Policy can join). Production signing certificates should come from a Conformance-Program-listed CA, not an ad-hoc cert.
**For DMP outputs**: `embed-c2pa.py` now supports `--ai-disclosure`. Pass it to embed the C2PA 2.4 `c2pa.ai-disclosure` assertion alongside the existing IPTC digital-source-type claim. The combination gives you both human-readable (IPTC) and machine-readable (`c2pa.ai-disclosure`) EU AI Act **Article 50** signaling — this is the deployer-side machine-readable pathway the final Code of Practice (10 June 2026) points to as the canonical marking mechanism. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context.
## When to invoke
- Right after any AI image / video / audio generation step in the engagement workflow (Part 11 — AI Creative Instructions output) - Before handing a generated asset to the design team for review - As a pre-publish gate in `/digital-marketing-pro:check` for EU-targeted assets - Bulk-applying to a backlog of AI-generated assets before EU AI Act enforcement on 2 Aug 2026
## Quick examples
```bash # Single asset — image generated by Vertex AI / Nano Banana Pro /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --prompt "minimalist product hero shot, soft natural lighting"
# Video with human review tracked /digital-marketing-pro:c2pa-metadata \ --input campaigns/launch-video-v3.mp4 \ --output campaigns/signed/launch-video-v3.mp4 \ --brand "Acme Corp" \ --generator "Runway Gen-4" \ --ai-claim ai-generated-content \ --reviewer "Jane Smith"
# EU-targeted asset — add the machine-readable Article 50 AI-disclosure assertion (C2PA 2.4) /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --ai-disclosure \ --prompt "minimalist product hero shot, soft natural lighting"
# Human-created image with AI-assisted edits /digital-marketing-pro:c2pa-metadata \ --input assets/founder-headshot-edited.jpg \ --output assets/signed/founder-headshot-edited.jpg \ --brand "Acme Corp" \ --generator "Adobe Generative Fill" \ --ai-claim ai-assisted-edits
# Production sign with a real C2PA signing certificate /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --signing-cert /secure/c2pa-prod-cert.pem \ --signing-key /secure/c2pa-prod-key.pem ```
## AI claim values (IPTC digital source type)
| Value | When to use | Maps to IPTC URI | |---|---|---| | `ai-generated-content` | Asset fully generated by AI | `algorithmicMedia` | | `ai-assisted-edits` | Human-created + AI-edited (e.g. Generative Fill) | `compositeWithTrainedAlgorithmicMedia` | | `ai-no-substantive-changes` | AI used (e.g. upscaling) but no semantic change | `minorHumanEdits` |
The IPTC vocabulary is what EU AI Act regulators reference — using these values rather than ad-hoc strings makes the asset interoperable with the Article 50 enforcement tooling.
## Supported asset formats
`.png` · `.jpg/.jpeg` · `.webp` · `.gif` · `.tiff` · `.mp4` · `.mov` · `.webm` · `.mp3` · `.wav` · `.pdf`
## Signing certificate
Production C2PA signatures require a certificate from a CAI-recognized signing authority. The script will use one if you pass `--signing-cert` and `--signing-key`. If you omit them, the script generates a **self-signed 90-day dev certificate** for development testing only — a self-signed asset will verify as "signature present but signer not in trust list" at [contentcredentials.org/verify](https://contentcredentials.org/verify).
For production deployment:
1. Obtain a C2PA-compatible signing certificate from a CAI-recognized authority (Adobe, Truepic, Numbers Protocol, Microsoft Azure Confidential Ledger). 2. Store the cert + key securely (do NOT commit to git; use an environment-variable path or secret store). 3. Pass `--signing-cert` and `--signing-key` on every production invocation.
Reference: [opensource.contentauthenticity.org/docs/manifest/signing-manifests/](https://opensource.contentauthenticity.org/docs/manifest/signing-manifests/)
## Python dependencies
- `c2pa-python>=0.5.0` — auto-installed on first run via `pip install` - `cryptography` — only needed for the dev self-signed cert path; auto-installed if missing
Both are part of the plugin's **Full mode** (~50 MB) — see `pip install -r scripts/requirements.txt` in the README.
## Output
The script prints a JSON status report to stdout:
```json { "status": "success", "input": "assets/q3-launch-hero.png", "output": "assets/signed/q3-launch-hero.png", "size_bytes": 482371, "brand": "Acme Corp", "generator": "Vertex AI / Nano Banana Pro", "ai_claim": "ai-generated-content", "created": "2026-05-16T10:30:00+00:00", "manifest_assertions": ["c2pa.actions", "stds.schema-org.CreativeWork"], "using_dev_cert": false, "verify_url": "https://contentcredentials.org/verify" } ```
## Integration with the engagement workflow
In a full 12-part engagement, this skill plugs in at **Part 11 — AI Creative Instructions output**. After a creative brief is rendered as an actual asset (by your creative tooling or a manual creative process), the resulting file passes through `c2pa-metadata` before being checked in to `engagements/<slug>/11-creative-briefs/signed/`.
The `/digital-marketing-pro:check` pre-publish gate should also verify that all AI-generated assets in an EU-targeted campaign carry a C2PA manifest. v3.4 adds this verification to the EU jurisdiction rule pack in `skills/context-engine/compliance-rules.md`.
## Related
- `/digital-marketing-pro:check` — pre-publish quality gate (now verifies C2PA manifest on AI assets for EU campaigns) - `skills/context-engine/compliance-rules.md` — EU AI Act Article 50 rule pack - `skills/influencer-creator/ftc-compliance.md` — FTC endorsement disclosure requirements - [C2PA Specification 2.4 (April 2026)](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html) — defines the `c2pa.ai-disclosure` assertion (Article 50 machine-readable pathway); [Content Credentials 2.3 launch (Feb 2026)](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/) - [Content Authenticity Initiative](https://contentauthenticity.org/)
Source provenance
Decision snapshot
787 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for c2pa-metadata, ready for a manual X post.
c2pa-metadata: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, T... 787 stars https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x
Listing + install path for c2pa-metadata: https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x Install: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to indranilbanerjee but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata/audit)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)indranilbanerjee
@indranilbanerjee
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsSandbox only
Install targets
Codex install prompt
Install the "c2pa-metadata" agent skill from https://github.com/indranilbanerjee/digital-marketing-pro/tree/main/skills/c2pa-metadata. Read its SKILL.md or equivalent instructions first, install only the files needed for this workspace, and summarize any required setup before using it. Skill purpose: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish. After the install attempt, report the result to https://www.openagentskill.com/api/agent/outcome with POST JSON {"event_id":"install_<unique-id>","skill_slug":"indranilbanerjee-c2pa-metadata","task":"Install c2pa-metadata","agent":"codex","outcome":"success","install_used":true}. Replace event_id with a unique value and outcome with success or failed. Report success only after the skill is installed and a minimal verification passes.Supply asset profile
Code review, repo analysis, testing, CI, GitHub, DevOps, and developer workflow skills.
Scenario
GitHub automation
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Agent fit
Claude Code + CLI + Codex
Codex, Claude Code, Cursor, CLI, or custom agents.
Install
Ready
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Maintenance
fresh
21d since push
Risk
Needs review
Dependency or permission surface needs review
GitHub quality
787
76/100 Quality · 75/100 Trust
Coverage tags
Review notes
Dependency or permission surface needs review · Permission surface may require sandboxing
Agent adoption scorecard
These scores combine public repository metadata, OpenAgentSkill review signals, maintenance freshness, and install readiness. They are a shortlist signal, not a replacement for human review.
Quality
StrongSolid option that is likely worth shortlisting for production workflows.
Trust
Sandbox onlyUseful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
Audit
Needs reviewA machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
OpenAgentSkill Trust Score v5
Run only in a sandbox and compare close alternatives before using it for real work.
Stars
787 GitHub stars
Repo activity
787 stars, 132 forks
Maintenance
21d since push
License
MIT
Install
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Install safety
Agent-readable metadata
Use this block or the embedded JSON to decide whether an agent should install this skill, choose an alternative, or ask for human review first.
Suited tasks
Suited agents
Install decision
Trust and risk
Outcome loop
Install command
npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataDo not use when
Agent safety v2
This skill should not be selected by an agent without explicit human security review.
Do not auto-install. Inspect the source, dependencies, and permission surface first.
high
Skill metadata references terminal, CLI, shell, subprocess, or command execution workflows.
medium
Skill likely fetches remote pages, APIs, repositories, or external services.
medium
Skill may read or write project files, documents, generated artifacts, or local workspace state.
high
Skill metadata references credentials, tokens, environment variables, or secret-bearing workflows.
Agent resolve plan
The Resolve API returns the selected skill, alternatives, safety policy, audit notes, install target, and copy-paste prompt an agent can follow without scraping this page.
Open JSON
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Resolve text
/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium&format=text
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
Agent should check
Copy prompt
Task: Use c2pa-metadata in this workspace.
Resolve first: https://www.openagentskill.com/api/agent/resolve?task=Use%20c2pa-metadata%20for%20an%20agent%20workflow&agent=codex&max_risk=medium
Review install handoff: https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install
Install command: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Before running it, summarize audit warnings, required permissions, and the fallback skill if install is risky.Agent handoff
Use the public install endpoint to fetch the command, safety checklist, target prompts, and canonical links for this skill.
Install handoff
/api/skills/indranilbanerjee-c2pa-metadata/install
LLM text format
/api/skills/indranilbanerjee-c2pa-metadata/install?format=text
Find alternatives
/api/skills/search?q=c2pa-metadata&limit=3
Agent prompt
Use c2pa-metadata for this task. Review https://www.openagentskill.com/api/skills/indranilbanerjee-c2pa-metadata/install, then install with: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadataRegistry metadata
This page exposes the same decision, trust, audit, use-case, and install signals through the Registry API, so agents can rank this skill without scraping the UI.
Manifest
/api/registry/manifest/indranilbanerjee-c2pa-metadata
LLM text
/api/registry/manifest/indranilbanerjee-c2pa-metadata?format=text
Install alias
/api/registry/install/indranilbanerjee-c2pa-metadata
Recommend
/api/registry/recommend?task=Use%20c2pa-metadata%20in%20an%20agent%20workflow&limit=3
Agent fit
GitHub automation
Platforms
Claude Code
Audit report
A machine-readable review of install readiness, security metadata, maintenance, and adoption risk.
Agent decision cockpit
Use this as a leading candidate, then validate the README and install path in your own agent stack.
Role in stack
Primary pick
Primary fit
GitHub automation
Trust label
Production-ready
Install path
Command ready
Use when
Evidence
review first
Implementation path
Trust profile
Useful candidate with missing or mixed trust signals. Keep it in an isolated workspace until the outcome loop proves task fit.
GitHub adoption
INFO787 GitHub stars
Stars/forks activity
INFO787 stars, 132 forks; issue activity unavailable in current metadata
Recent maintenance
PASS21d since push
License clarity
PASSMIT
Good signals
Review before install
Recommended action
Run only in a sandbox and compare close alternatives before using it for real work.
Quality profile
Solid option that is likely worth shortlisting for production workflows.
Workflow fit
Manage repositories
I need my agent to triage GitHub issues, review pull requests, and summarize repository changes.
Process rich media
I need my agent to process images, video, or audio and extract useful information.
Reduce risk
I need my agent to scan a project for security risks and summarize what needs attention.
Workflow fit
Inspect, patch, and verify code
A workflow for software agents that inspect repositories, review pull requests, generate tests, and turn findings into shippable patches.
Operate and verify web apps
A workflow for agents that navigate products, fill forms, take screenshots, and verify real user flows across web applications.
Design, build, test, and ship interfaces
A practical workflow for agents that turn product briefs or Figma designs into polished frontend code, review the result, test it in a browser, and prepare a safe deployment.
Alternative shortlist
Similar skills that may fit this task.
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
Infisical is the open-source platform for secrets, certificates, and privileged access management.
--- name: c2pa-metadata description: "Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2 Aug 2026), and a JSON status report. Triggers on \"/digital-marketing-pro:c2pa-metadata\", \"sign this AI image for EU compliance\", \"add content credentials to this asset\", \"embed provenance metadata\", \"mark this video as AI-generated\". Uses a self-signed dev certificate unless --signing-cert/--signing-key are supplied; pairs with /digital-marketing-pro:check, which verifies manifests pre-publish." ---
# /digital-marketing-pro:c2pa-metadata — Embed Content Authenticity Provenance
## Purpose
Wraps `scripts/embed-c2pa.py` to add a **C2PA (Coalition for Content Provenance and Authenticity) manifest** to any AI-generated marketing asset. The manifest carries a machine-readable provenance trail (who generated it, what generator was used, what prompt produced it, when it was reviewed) plus a visible AI-generation claim in the IPTC digital-source-type vocabulary.
This is the technical mechanism brands use to comply with:
- **EU AI Act Article 50** (applicable 2 August 2026) — generative-AI marketing content must be marked in a machine-readable format using open, interoperable standards. C2PA is the emerging backbone. Penalty for non-compliance: up to **€15 million or 3% global annual turnover**. - **NY synthetic-performer disclosure law** (effective June 2026) — $1K–$5K per violation, $10K repeat; applies to synthetic influencers and AI-generated endorsements. - **FTC May 2026 endorsement guidance** — covers AI testimonials and synthetic creator content. - **Australia Online Safety Act / UK Online Safety Act** — emerging deepfake disclosure requirements.
The resulting asset can be inspected by any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, [contentcredentials.org/verify](https://contentcredentials.org/verify)).
### C2PA spec versions to be aware of (June 2026)
- **Content Credentials 2.3** (released 9 February 2026 — [launch post](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/)) added format support for: **live video** (broadcast/streaming), **plain text documents**, **OGG Vorbis audio**, **large AVI video files**, and **EXIF Original Preservation Images**. If a brand is signing live-stream video or text-based assets for the first time, 2.3 is the floor version to target. - **C2PA Spec 2.4** (April 2026 — [spec.c2pa.org/specifications/specifications/2.4](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html)) introduces the **AI Disclosure Assertion (`c2pa.ai-disclosure`)** for machine-readable AI transparency info — this is the assertion the EU AI Act Article 50 deployer pathway will rely on. The final Code of Practice on Transparency of AI-Generated Content (published 10 June 2026) references C2PA-style assertions as the canonical machine-readable marking mechanism for both providers and deployers. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context. - The **C2PA Trust List** is now handled via the public C2PA Conformance Program (any CA meeting the Certificate Policy can join). Production signing certificates should come from a Conformance-Program-listed CA, not an ad-hoc cert.
**For DMP outputs**: `embed-c2pa.py` now supports `--ai-disclosure`. Pass it to embed the C2PA 2.4 `c2pa.ai-disclosure` assertion alongside the existing IPTC digital-source-type claim. The combination gives you both human-readable (IPTC) and machine-readable (`c2pa.ai-disclosure`) EU AI Act **Article 50** signaling — this is the deployer-side machine-readable pathway the final Code of Practice (10 June 2026) points to as the canonical marking mechanism. See `skills/context-engine/eu-code-of-practice.md` for the full Article 50 context.
## When to invoke
- Right after any AI image / video / audio generation step in the engagement workflow (Part 11 — AI Creative Instructions output) - Before handing a generated asset to the design team for review - As a pre-publish gate in `/digital-marketing-pro:check` for EU-targeted assets - Bulk-applying to a backlog of AI-generated assets before EU AI Act enforcement on 2 Aug 2026
## Quick examples
```bash # Single asset — image generated by Vertex AI / Nano Banana Pro /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --prompt "minimalist product hero shot, soft natural lighting"
# Video with human review tracked /digital-marketing-pro:c2pa-metadata \ --input campaigns/launch-video-v3.mp4 \ --output campaigns/signed/launch-video-v3.mp4 \ --brand "Acme Corp" \ --generator "Runway Gen-4" \ --ai-claim ai-generated-content \ --reviewer "Jane Smith"
# EU-targeted asset — add the machine-readable Article 50 AI-disclosure assertion (C2PA 2.4) /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --ai-disclosure \ --prompt "minimalist product hero shot, soft natural lighting"
# Human-created image with AI-assisted edits /digital-marketing-pro:c2pa-metadata \ --input assets/founder-headshot-edited.jpg \ --output assets/signed/founder-headshot-edited.jpg \ --brand "Acme Corp" \ --generator "Adobe Generative Fill" \ --ai-claim ai-assisted-edits
# Production sign with a real C2PA signing certificate /digital-marketing-pro:c2pa-metadata \ --input assets/q3-launch-hero.png \ --output assets/signed/q3-launch-hero.png \ --brand "Acme Corp" \ --generator "Vertex AI / Nano Banana Pro" \ --ai-claim ai-generated-content \ --signing-cert /secure/c2pa-prod-cert.pem \ --signing-key /secure/c2pa-prod-key.pem ```
## AI claim values (IPTC digital source type)
| Value | When to use | Maps to IPTC URI | |---|---|---| | `ai-generated-content` | Asset fully generated by AI | `algorithmicMedia` | | `ai-assisted-edits` | Human-created + AI-edited (e.g. Generative Fill) | `compositeWithTrainedAlgorithmicMedia` | | `ai-no-substantive-changes` | AI used (e.g. upscaling) but no semantic change | `minorHumanEdits` |
The IPTC vocabulary is what EU AI Act regulators reference — using these values rather than ad-hoc strings makes the asset interoperable with the Article 50 enforcement tooling.
## Supported asset formats
`.png` · `.jpg/.jpeg` · `.webp` · `.gif` · `.tiff` · `.mp4` · `.mov` · `.webm` · `.mp3` · `.wav` · `.pdf`
## Signing certificate
Production C2PA signatures require a certificate from a CAI-recognized signing authority. The script will use one if you pass `--signing-cert` and `--signing-key`. If you omit them, the script generates a **self-signed 90-day dev certificate** for development testing only — a self-signed asset will verify as "signature present but signer not in trust list" at [contentcredentials.org/verify](https://contentcredentials.org/verify).
For production deployment:
1. Obtain a C2PA-compatible signing certificate from a CAI-recognized authority (Adobe, Truepic, Numbers Protocol, Microsoft Azure Confidential Ledger). 2. Store the cert + key securely (do NOT commit to git; use an environment-variable path or secret store). 3. Pass `--signing-cert` and `--signing-key` on every production invocation.
Reference: [opensource.contentauthenticity.org/docs/manifest/signing-manifests/](https://opensource.contentauthenticity.org/docs/manifest/signing-manifests/)
## Python dependencies
- `c2pa-python>=0.5.0` — auto-installed on first run via `pip install` - `cryptography` — only needed for the dev self-signed cert path; auto-installed if missing
Both are part of the plugin's **Full mode** (~50 MB) — see `pip install -r scripts/requirements.txt` in the README.
## Output
The script prints a JSON status report to stdout:
```json { "status": "success", "input": "assets/q3-launch-hero.png", "output": "assets/signed/q3-launch-hero.png", "size_bytes": 482371, "brand": "Acme Corp", "generator": "Vertex AI / Nano Banana Pro", "ai_claim": "ai-generated-content", "created": "2026-05-16T10:30:00+00:00", "manifest_assertions": ["c2pa.actions", "stds.schema-org.CreativeWork"], "using_dev_cert": false, "verify_url": "https://contentcredentials.org/verify" } ```
## Integration with the engagement workflow
In a full 12-part engagement, this skill plugs in at **Part 11 — AI Creative Instructions output**. After a creative brief is rendered as an actual asset (by your creative tooling or a manual creative process), the resulting file passes through `c2pa-metadata` before being checked in to `engagements/<slug>/11-creative-briefs/signed/`.
The `/digital-marketing-pro:check` pre-publish gate should also verify that all AI-generated assets in an EU-targeted campaign carry a C2PA manifest. v3.4 adds this verification to the EU jurisdiction rule pack in `skills/context-engine/compliance-rules.md`.
## Related
- `/digital-marketing-pro:check` — pre-publish quality gate (now verifies C2PA manifest on AI assets for EU campaigns) - `skills/context-engine/compliance-rules.md` — EU AI Act Article 50 rule pack - `skills/influencer-creator/ftc-compliance.md` — FTC endorsement disclosure requirements - [C2PA Specification 2.4 (April 2026)](https://spec.c2pa.org/specifications/specifications/2.4/specs/C2PA_Specification.html) — defines the `c2pa.ai-disclosure` assertion (Article 50 machine-readable pathway); [Content Credentials 2.3 launch (Feb 2026)](https://c2pa.org/the-c2pa-launches-content-credentials-2-3-and-celebrates-5-years-of-impact-across-the-digital-ecosystem/) - [Content Authenticity Initiative](https://contentauthenticity.org/)
Source provenance
Decision snapshot
787 GitHub stars
Audit
Install and adoption review
Agent-proven evidence
Outcome reports after resolve, review, install, and one narrow run.
No agent outcome data yet. The first agent run can report success, setup needs, risk blocks, failure, or not-relevant through /api/agent/outcome.
Install
Free and open source. Review the report before installing into production agents.
Growth loop
Scenario-led draft for c2pa-metadata, ready for a manual X post.
c2pa-metadata: Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, T... 787 stars https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x
Listing + install path for c2pa-metadata: https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=x Install: npx skills add indranilbanerjee/digital-marketing-pro --skill c2pa-metadata
Listing source
This listing was indexed from public sources and is not marked official until a maintainer claim is approved.
Attribution links to the public repository or creator profile. Creators can claim the listing to update ownership signals.
Claim this skillOwner claim
This Registry indexed listing is attributed to indranilbanerjee but is not marked official yet. Claim it to add a verified owner signal and make future launch, install, and audit updates easier to trust.
Creator backlink kit
Show the canonical listing, current trust and audit signals, and real Agent-Proven evidence where developers evaluate the repository.
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata/audit)
[](https://www.openagentskill.com/skills/indranilbanerjee-c2pa-metadata?ref=github&utm_source=github&utm_medium=referral&utm_campaign=creator_badge)indranilbanerjee
@indranilbanerjee
Share whether this skill looks useful for your agent workflow. Aggregated feedback improves rankings over time.
Sandbox only
Wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
16.3K StarsMaigret
🕵️♂️ Collect a dossier on a person by username from 3000+ sites
32.9K StarsNuclei
Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.
29.2K StarsInfisical
Infisical is the open-source platform for secrets, certificates, and privileged access management.
27.4K StarsPermission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness
Permission surface
secrets or environment access, shell or command execution
Agent outcomes
No agent outcome data yet
Docs
Strong README/SKILL.md context
Risk summary
Install readiness