# Markup Detection

> This skill should be used when the user asks for markup detection, detect manipulation, image tampering, deepfake detection, document integrity, hidden markup, metadata forensics, EXIF analysis, content authenticity, synthetic media, altered image, C2PA, or provenance verification across documents, images, and video. Guides workflow-level assessment of visual tampering indicators (splicing, cloning, inconsistent lighting or shadows, compression artifacts), metadata and provenance checks (EXIF, hashes, source chain), document revision and hidden markup (tracked changes, comments, invisible text), synthetic-media and deepfake red flags, watermarking and content-credentials concepts, and structured reporting with confidence levels and explicit limitations—not training detection models (ml-research-engineer-safeguards), cryptographic watermark design (cryptographer-specialist), full digital forensics lab attribution or legal conclusions, or blockchain-only tracing unless the user scopes on-chain context.

- Skill: `daemon-blockint-tech/markup-detection` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/markup-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/markup-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/markup-detection

---


# Markup Detection

## When to Use

- Assess whether **images or video** show signs of tampering, compositing, or inconsistent capture metadata
- Review **documents** (Office, PDF) for hidden markup, revision layers, comments, or undisclosed edits
- Run **metadata and provenance** checks—EXIF/XMP, file hashes, embedded timestamps, export vs capture mismatches
- Triage **synthetic media** and **deepfake** concerns using observable workflow indicators (not model training)
- Interpret **watermarks**, **C2PA / content credentials**, and publisher attestation claims at a high level
- Produce **investigation memos** with confidence tiers, evidence tables, and stated limitations
- Compare **source chain** (original upload, reposts, screenshots) when authenticity is disputed

## When NOT to Use

- Train, fine-tune, or benchmark **detection ML models** → `ml-research-engineer-safeguards`
- Design **cryptographic watermarks**, steganography, or signing schemes → `cryptographer-specialist`
- Perform **full digital forensics** with chain-of-custody, disk imaging, or courtroom expert testimony → specialized forensics vendor / `digital-forensics-analyst` (when installed)
- Conduct **authorized offensive security** or adversarial AI red teaming → `ai-redteam`, `penetration-tester`
- Map findings to **audit attestations**, SOC 2 opinions, or control effectiveness → `auditor`, `compliance-engineer`
- **Blockchain-only** address tracing, sanctions, or on-chain attribution → blockint / investigation skills unless user adds document/media context
- Issue **legal conclusions** on fraud, defamation, or admissibility → counsel; state facts and uncertainty only

## Related skills

| Need | Skill |
|---|---|
| IAM, logging, DLP, and control implementation | `information-security-engineer` |
| Adversarial testing of LLM apps and copilots | `ai-redteam` |
| Crypto signing, PKI, and watermark protocol design | `cryptographer-specialist` |
| Internal audit, evidence standards, deficiency write-ups | `auditor` |
| Technical control evidence and CCM pipelines | `compliance-engineer` |
| Production LLM features and RAG (not media forensics) | `ai-engineer` |
| AI governance and risk tiers for synthetic content policy | `ai-risk-governance` |
| Disk/memory/log forensics and chain of custody | `digital-forensics-analyst` (when installed) |

## Core Workflows

### 1. Intake and scope

1. Identify **asset type** (image, video, audio, PDF, Office, email archive, web capture)
2. Record **claimed provenance** (author, date, device, platform, original URL)
3. List **decision needed** (internal triage, incident response, press review, litigation support prep—not legal advice)
4. Note **constraints** (only copies available, re-encoded social video, missing originals)
5. Select reference files from the table below

| Topic | Reference |
|---|---|
| Scope and boundaries | `references/markup_detection_scope.md` |
| Visual tampering heuristics | `references/visual_media_tampering_indicators.md` |
| Documents, EXIF, hashes | `references/document_integrity_and_metadata.md` |
| Synthetic media / deepfakes | `references/synthetic_media_and_deepfakes.md` |
| Watermarks, C2PA, credentials | `references/watermarks_provenance_c2pa.md` |
| Reporting and limits | `references/investigation_reporting_and_limits.md` |

### 2. Preserve and catalog evidence

1. Obtain **best available originals**; avoid unnecessary re-saving that strips metadata
2. Compute **cryptographic hashes** (SHA-256) per file; record filename, size, received time
3. Capture **context screenshots** (platform UI, URLs, conversation thread) separately from the asset
4. Document **tool versions** used for extraction or enhancement
5. If chain of custody matters, route to formal forensics—do not improvise custody from this skill alone

### 3. Layered analysis

Run checks in parallel where possible; **corroborate** across layers before strong conclusions.

1. **Structural / visual** — lighting, shadows, edges, noise, perspective, duplicate regions (see visual reference)
2. **Metadata** — EXIF/XMP, container timestamps, software strings, GPS/device fields (see document integrity reference)
3. **Document markup** — tracked changes, comments, hidden text, embedded objects (see document integrity reference)
4. **Synthetic-media signals** — face boundary, blink cadence, audio-visual sync at workflow level (see synthetic reference)
5. **Attestation** — C2PA manifest, publisher credentials, visible watermarks (see watermarks reference)

### 4. Score and report

1. Classify each finding: **observed fact** vs **inference** vs **hypothesis**
2. Assign **confidence** (High / Medium / Low) per finding with rationale
3. State **alternative explanations** (heavy compression, beauty filters, legitimate edits)
4. Deliver memo using templates in `references/investigation_reporting_and_limits.md`
5. Recommend **next steps** (obtain original, specialist lab, legal review) when confidence is insufficient

## Quality bar

- Never present **heuristic suspicion** as definitive proof of manipulation
- Separate **undisclosed editorial markup** from **malicious tampering** when intent is unknown
- Call out **re-encoding**, **screenshots**, and **platform transcoding** as common false-positive drivers
- Cite **which checks were not run** when tooling or access was missing