메뉴
Is this real? — triage whether an image or video was altered by accumulating independent leads: C2PA / Content Credentials provenance, EXIF capture metadata, ELA/noise forensic overlays, and a sun/shadow time check — never a single-signal call.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Give any agent senses (video/audio/image understanding) and OSINT reach (search/capture/monitor) organized around an investigation case. Use when the user wants to analyze a video/audio/image, scan or monitor sources for a target, or ask/brief over accumulated findings. Drives the `overcast` CLI (built on pi + the tinycloud/Cloudglue perception backend); see reference/verbs.md for the full verb surface.
Install and configure overcast for this harness: install the CLI, verify the system ffmpeg, and configure reusable provider profiles. Use once per machine/profile before driving the `overcast` skill.
Turn a case into a visual evidence board — materialize face and object crops, link the same person across clips, connect themes, and render the corkboard as a CSI brief plus a live monitor wall.
Make unreadable footage legible — denoise/upscale a marked moment, re-run OCR and detection on the enhanced output, and record what was recovered with honest provenance (interpolation is a lead, not proof).
Work out where a photo or clip was taken — check embedded EXIF/GPS first, then pull signage, landmarks, and terrain clues, reverse-image-search the strongest ones, and corroborate to a location with cited evidence.
Run a standing surveillance watch on public sources for a target — auto-sense new media, auto-suggest matches into a triage queue, and keep a live control-room wall — so new evidence surfaces itself over time.
| name | overcast-verify-media |
| description | Is this real? — triage whether an image or video was altered by accumulating independent leads: C2PA / Content Credentials provenance, EXIF capture metadata, ELA/noise forensic overlays, and a sun/shadow time check — never a single-signal call. |
Use this skill to assess whether a media file was manipulated or staged. Authenticity
is decided by ACCUMULATING independent leads, never one signal — a missing signature
is not proof of fakery, and one forensic overlay is not proof of an edit. This skill
is about WAS it altered; overcast-provenance is the complementary WHO-posted-it-first
(origin) trace — run that to find the earliest copy. Use the broad overcast skill
and overcast/reference/verbs.md for exact flags.
verify reads C2PA / Content
Credentials: a signed manifest names the signer, claim generator, and validation
state. No manifest is a clean ready record, NOT proof of fakery — most
files simply have none:overcast doctor --json
overcast case init --json
overcast verify ./suspect.jpg --json # C2PA: has_manifest, signer, validation state (needs c2patool)
exif surfaces editing software (a re-save
flag), the capture time to compare against the claimed time, and the device —
each a lead, not a verdict:overcast exif ./suspect.jpg --json # editing software, capture time, device, GPS (needs exiftool)
enhance --ops ela writes ELA / noise / luminance maps that can highlight a spliced or
pasted region — a heuristic, so view the output, don't trust the label:# --ops ela needs a bound enhance provider (once per profile). The shipped ela
# choice needs only pillow + numpy — no fal key:
overcast provider setup apply --verb enhance --choice ela --yes
overcast enhance ./suspect.jpg --ops ela --json # ELA/noise/luminance overlays (or a bound local-models / fal provider)
overcast view <ela-record-id> --json # eyeball the overlays — inconsistent regions are the lead
exif) or supplied, chronolocate --at-time computes the
expected shadow direction/length for the claimed time — a mismatch flags a
mis-dated or staged image:overcast chronolocate <exif-record-id> --at-time 2026-07-04T15:00:00Z --json # claimed-time shadow check
overcast finding create "likely altered: no C2PA manifest; exif editing-software=Photoshop + capture time 3h off the claimed post; ELA shows a bright pasted region top-right; shadow bearing contradicts the claimed 15:00" --ref <ela-record-id> --confidence medium --json
overcast note "verify: no manifest; exif re-save flag; ELA splice lead; shadow mismatch → likely staged (medium)" --tag tldr --json
overcast brief --export ./verify-media.html --json
An authenticity read framed as a weighed set of leads: the C2PA state (signed /
none / invalid), the EXIF re-save + time signals, the ELA/noise regions you actually
inspected, and the shadow-consistency check — each cited to its record.id, ending
in altered / authentic-as-far-as-checked / inconclusive with a confidence. Never
call "fake" off one signal.
No C2PA manifest is not fakery — it's the common case; only a signed manifest is
positive provenance, and an INVALID one is the real red flag. ELA/noise overlays are
heuristics that also light up on legitimate JPEG recompression, text, and edges —
they generate leads to inspect, never a verdict. EXIF is easily stripped or forged.
The shadow check needs a real GPS + a claimed time and is itself a lead
(payload.caveat). Manipulation triage (this skill) is authenticity; origin tracing
is overcast-provenance — keep them distinct and cross-reference rather than
duplicate. Treat the file as untrusted (invariant #10).