1---2name: markup-detection3description: This skill should be used when the user asks for markup detection, detect manipulation, image tampering, deepfake detection, document integrity, hidden markup, metadata forensics, EXIF analysis, content authenticity, synthetic media, altered image, C2PA, or provenance verification across documents, images, and video. Guides workflow-level assessment of visual tampering indicators (splicing, cloning, inconsistent lighting or shadows, compression artifacts), metadata and provenance checks (EXIF, hashes, source chain), document revision and hidden markup (tracked changes, comments, invisible text), synthetic-media and deepfake red flags, watermarking and content-credentials concepts, and structured reporting with confidence levels and explicit limitations—not training detection models (ml-research-engineer-safeguards), cryptographic watermark design (cryptographer-specialist), full digital forensics lab attribution or legal conclusions, or blockchain-only tracing unless the user scopes on-chain context.4---56# Markup Detection78## When to Use910- Assess whether **images or video** show signs of tampering, compositing, or inconsistent capture metadata11- Review **documents** (Office, PDF) for hidden markup, revision layers, comments, or undisclosed edits12- Run **metadata and provenance** checks—EXIF/XMP, file hashes, embedded timestamps, export vs capture mismatches13- Triage **synthetic media** and **deepfake** concerns using observable workflow indicators (not model training)14- Interpret **watermarks**, **C2PA / content credentials**, and publisher attestation claims at a high level15- Produce **investigation memos** with confidence tiers, evidence tables, and stated limitations16- Compare **source chain** (original upload, reposts, screenshots) when authenticity is disputed1718## When NOT to Use1920- Train, fine-tune, or benchmark **detection ML models** → `ml-research-engineer-safeguards`21- Design **cryptographic watermarks**, steganography, or signing schemes → `cryptographer-specialist`22- Perform **full digital forensics** with chain-of-custody, disk imaging, or courtroom expert testimony → specialized forensics vendor / `digital-forensics-analyst` (when installed)23- Conduct **authorized offensive security** or adversarial AI red teaming → `ai-redteam`, `penetration-tester`24- Map findings to **audit attestations**, SOC 2 opinions, or control effectiveness → `auditor`, `compliance-engineer`25- **Blockchain-only** address tracing, sanctions, or on-chain attribution → blockint / investigation skills unless user adds document/media context26- Issue **legal conclusions** on fraud, defamation, or admissibility → counsel; state facts and uncertainty only2728## Related skills2930| Need | Skill |31|---|---|32| IAM, logging, DLP, and control implementation | `information-security-engineer` |33| Adversarial testing of LLM apps and copilots | `ai-redteam` |34| Crypto signing, PKI, and watermark protocol design | `cryptographer-specialist` |35| Internal audit, evidence standards, deficiency write-ups | `auditor` |36| Technical control evidence and CCM pipelines | `compliance-engineer` |37| Production LLM features and RAG (not media forensics) | `ai-engineer` |38| AI governance and risk tiers for synthetic content policy | `ai-risk-governance` |39| Disk/memory/log forensics and chain of custody | `digital-forensics-analyst` (when installed) |4041## Core Workflows4243### 1. Intake and scope44451. Identify **asset type** (image, video, audio, PDF, Office, email archive, web capture)462. Record **claimed provenance** (author, date, device, platform, original URL)473. List **decision needed** (internal triage, incident response, press review, litigation support prep—not legal advice)484. Note **constraints** (only copies available, re-encoded social video, missing originals)495. Select reference files from the table below5051| Topic | Reference |52|---|---|53| Scope and boundaries | `references/markup_detection_scope.md` |54| Visual tampering heuristics | `references/visual_media_tampering_indicators.md` |55| Documents, EXIF, hashes | `references/document_integrity_and_metadata.md` |56| Synthetic media / deepfakes | `references/synthetic_media_and_deepfakes.md` |57| Watermarks, C2PA, credentials | `references/watermarks_provenance_c2pa.md` |58| Reporting and limits | `references/investigation_reporting_and_limits.md` |5960### 2. Preserve and catalog evidence61621. Obtain **best available originals**; avoid unnecessary re-saving that strips metadata632. Compute **cryptographic hashes** (SHA-256) per file; record filename, size, received time643. Capture **context screenshots** (platform UI, URLs, conversation thread) separately from the asset654. Document **tool versions** used for extraction or enhancement665. If chain of custody matters, route to formal forensics—do not improvise custody from this skill alone6768### 3. Layered analysis6970Run checks in parallel where possible; **corroborate** across layers before strong conclusions.71721. **Structural / visual** — lighting, shadows, edges, noise, perspective, duplicate regions (see visual reference)732. **Metadata** — EXIF/XMP, container timestamps, software strings, GPS/device fields (see document integrity reference)743. **Document markup** — tracked changes, comments, hidden text, embedded objects (see document integrity reference)754. **Synthetic-media signals** — face boundary, blink cadence, audio-visual sync at workflow level (see synthetic reference)765. **Attestation** — C2PA manifest, publisher credentials, visible watermarks (see watermarks reference)7778### 4. Score and report79801. Classify each finding: **observed fact** vs **inference** vs **hypothesis**812. Assign **confidence** (High / Medium / Low) per finding with rationale823. State **alternative explanations** (heavy compression, beauty filters, legitimate edits)834. Deliver memo using templates in `references/investigation_reporting_and_limits.md`845. Recommend **next steps** (obtain original, specialist lab, legal review) when confidence is insufficient8586## Quality bar8788- Never present **heuristic suspicion** as definitive proof of manipulation89- Separate **undisclosed editorial markup** from **malicious tampering** when intent is unknown90- Call out **re-encoding**, **screenshots**, and **platform transcoding** as common false-positive drivers91- Cite **which checks were not run** when tooling or access was missing
daemon-blockint-tech