Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add indranilbanerjee/neels-plugins --skill c2pa-metadatagit clone --depth 1 https://github.com/indranilbanerjee/neels-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/indranilbanerjee/neels-plugins/c2pa-metadata)<a href="https://agentmods.dev/skills/indranilbanerjee/neels-plugins/c2pa-metadata"><img src="https://agentmods.dev/badge/skills/indranilbanerjee/neels-plugins/c2pa-metadata/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/indranilbanerjee/neels-plugins/c2pa-metadata"><img src="https://agentmods.dev/badge/skills/indranilbanerjee/neels-plugins/c2pa-metadata.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02474 |
| Opus 5.5 | $0.00012 | $0.00990 |
| Sonnet 5.5 | $0.00006 | $0.00495 |
| Haiku 4.5 | $0.00003 | $0.00247 |
Grade A, and why
c2pa-metadata scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
95% identical to c2pa-metadata — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/digital-marketing-pro:c2pa-metadata — Embed Content Authenticity Provenance
Purpose
Wraps scripts/embed-c2pa.py to add a C2PA (Coalition for Content Provenance and Authenticity) manifest to any AI-generated marketing asset. The manifest carries a machine-readable provenance trail (who generated it, what generator was used, what prompt produced it, when it was reviewed) plus a visible AI-generation claim in the IPTC digital-source-type vocabulary.
This is the technical mechanism brands use to comply with:
- EU AI Act Article 50 (applicable 2 August 2026) — generative-AI marketing content must be marked in a machine-readable format using open, interoperable standards. C2PA is the emerging backbone. Penalty for non-compliance: up to €15 million or 3% global annual turnover.
- NY synthetic-performer disclosure law (effective June 2026) — $1K–$5K per violation, $10K repeat; applies to synthetic influencers and AI-generated endorsements.
- FTC May 2026 endorsement guidance — covers AI testimonials and synthetic creator content.
- Australia Online Safety Act / UK Online Safety Act — emerging deepfake disclosure requirements.
The resulting asset can be inspected by any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, contentcredentials.org/verify).
C2PA spec versions to be aware of (June 2026)
- Content Credentials 2.3 (released 9 February 2026 — launch post) added format support for: live video (broadcast/streaming), plain text documents, OGG Vorbis audio, large AVI video files, and EXIF Original Preservation Images. If a brand is signing live-stream video or text-based assets for the first time, 2.3 is the floor version to target.
- C2PA Spec 2.4 (April 2026 — spec.c2pa.org/specifications/specifications/2.4) introduces the AI Disclosure Assertion (
c2pa.ai-disclosure) for machine-readable AI transparency info — this is the assertion the EU AI Act Article 50 deployer pathway will rely on. The final Code of Practice on Transparency of AI-Generated Content (published 10 June 2026) references C2PA-style assertions as the canonical machine-readable marking mechanism for both providers and deployers. Seeskills/context-engine/eu-code-of-practice.mdfor the full Article 50 context. - The C2PA Trust List is now handled via the public C2PA Conformance Program (any CA meeting the Certificate Policy can join). Production signing certificates should come from a Conformance-Program-listed CA, not an ad-hoc cert.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 154 lines · 30 tokens per session scan A 68aa6226ef4a
c2pa-metadata is a skill published in the GitHub repository indranilbanerjee/neels-plugins (6 stars, last pushed 2d ago), licensed MIT. It adds 30 tokens to every session and 2,474 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 95% identical to c2pa-metadata, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
c2pa-metadata
Embed C2PA provenance in AI-generated images, video or PDF by script. "add content credentials to this asset".
region-config
Configure a brand region: timezone, currency, compliance regimes, holidays. "set up the Japan market".
brand-safety-compliance
Scans outbound copy or creator-submitted content for 6 compliance red lines — medical/efficacy, exaggeration/absolute, beauty-permanence, financial/income, fake-scarcity, fake-rapport — and returns a block/warn verdict with fix suggestions. Use when the user asks to check, scan, review, or vet copy before sending, or…
internal-investigation
Reference: shared framework for managing internal investigations from intake through final memo — privileged investigation log, document processing with needle-finding, source coverage tracking, Q&A against the log, memo drafting, and audience summaries. Loaded by /investigation-open, /investigation-add…
infringement-triage
Infringement triage across trade mark, copyright, patent, and trade secret — a flag list with the factors cutting each way, not a finding. Use when assessing whether someone is infringing your IP or whether you might be infringing theirs, when a knockoff or copycat surfaces, or when deciding whether a matter is worth…
takedown
Draft a copyright takedown notice, triage one you received, or draft a counter-notice. Use when asserting copyright through an online notice (UK/EU and platform-specific regimes), when an incoming takedown needs triage into comply / counter / engage / ignore options, or when drafting a counter-notification. Handles UK…