Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add indranilbanerjee/socialforge --skill c2pa-signgit clone --depth 1 https://github.com/indranilbanerjee/socialforgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/indranilbanerjee/socialforge/c2pa-sign)<a href="https://agentmods.dev/skills/indranilbanerjee/socialforge/c2pa-sign"><img src="https://agentmods.dev/badge/skills/indranilbanerjee/socialforge/c2pa-sign/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/indranilbanerjee/socialforge/c2pa-sign"><img src="https://agentmods.dev/badge/skills/indranilbanerjee/socialforge/c2pa-sign.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.02082 |
| Opus 5 | $0.00062 | $0.01041 |
| Sonnet 5 | $0.00025 | $0.00416 |
| Haiku 4.5 | $0.00012 | $0.00208 |
Grade A, and why
c2pa-sign scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 141 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/socialforge:c2pa-sign — Embed Content Authenticity Provenance
Purpose
Context efficiency
Asset-heavy skill. Grep before Read the asset catalog (${CLAUDE_PLUGIN_DATA}/socialforge/brands/<brand>/asset-index.json) — never list the asset directory. Reference generated images / videos by path, not by loading metadata. Brand profile loads once per session.
Wraps scripts/c2pa_sign.py to add a C2PA manifest to any SocialForge-generated marketing asset. The manifest carries:
- Machine-readable provenance trail (brand, generator name, timestamp, prompt, target platform)
- IPTC digital-source-type vocabulary tag (
TRAINED_ALGORITHMIC_MEDIA/COMPOSITE_WITH_TRAINED_ALGORITHMIC_MEDIA/HUMAN_EDITS) - schema.org CreativeWork assertion (author = brand organization, dateCreated, publishingPrinciples = target platform)
Why this matters: EU AI Act Article 50 applies from 2 August 2026. Generative-AI marketing content distributed in EU markets must be marked in a machine-readable format using open, interoperable standards — C2PA is the emerging backbone. Penalty: up to €15 million or 3% global annual turnover. Additional disclosure obligations apply under NY synthetic-performer law (effective June 2026) and FTC May 2026 endorsement guidance.
The resulting asset is verifiable at contentcredentials.org/verify or in any C2PA-aware viewer (Adobe Photoshop, Lightroom, Truepic, Microsoft Copilot, etc.).
C2PA spec versions relevant to SocialForge (June 2026)
- Content Credentials 2.3 (released 9 February 2026 — launch post) added support for live video (broadcast/streaming), plain text documents, OGG Vorbis audio, large AVI video files, and EXIF Original Preservation Images. Relevant to SocialForge because:
- Live video signing matters if you're producing Reels / TikTok / Shorts streaming content alongside the planned monthly batch.
- EXIF Original Preservation Image format is the cleanest path for signing product photography that the brand wants to preserve through ad ops cropping.
- C2PA Spec 2.4 (April 2026 — spec.c2pa.org/specifications/specifications/2.4) introduces the AI Disclosure Assertion (
c2pa.ai-disclosure) — machine-readable AI transparency info that the EU AI Act Article 50 deployer pathway will read. Whenc2pa_sign.pyis on a C2PA SDK ≥ 0.36 that handles 2.4, include this assertion alongside the existing IPTC + schema.org tags. The combination is what the EU Code of Practice WG1/WG2 drafts reference as the canonical machine-readable mark. - C2PA Trust List is now handled via the public C2PA Conformance Program — production signing certificates should come from a Conformance-Program-listed CA.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 141 lines · 124 tokens per session scan A 983751245c3a
c2pa-sign is a skill published in the GitHub repository indranilbanerjee/socialforge (38 stars, last pushed 25d ago), licensed MIT. It adds 124 tokens to every session and 2,082 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
c2pa-metadata
Embed a C2PA provenance manifest into an AI-generated marketing asset (PNG, JPG, WebP, GIF, TIFF, MP4, MOV, WebM, MP3, WAV, PDF) via scripts/embed-c2pa.py — produces a signed copy of the file carrying IPTC digital-source-type AI claims, an optional c2pa.ai-disclosure assertion for EU AI Act Article 50 (applicable 2…
ai-media-generator
A workflow for turning ideas into prompts for AI-generated images, videos, and music across several media platforms. When needed, it can also send those prompts to the chosen platform through browser automation.
bria-fibo-image
Build and operate rights-aware Bria FIBO and FIBO Lite image-generation workflows with structured prompts, reference images, asynchronous status handling, webhooks, cost gates, and safe artifact downloads. Use when a user asks for Bria/FIBO generation, refinement, inspiration, reproducibility, hosted API integration…
media-provenance-rights
Provider-independent provenance, rights, consent, disclosure, and release governance for AI-generated media. Use when producing or reviewing generated images, video, audio, ads, avatars, product content, social clips, documentaries, localization, music, sound, or campaign assets that need source-rights checks…
moonvalley-marey
Produce video with Moonvalley's Marey model family (Marey Realism v1.5) — a filmmaker-oriented, 1080p/24fps generative video model marketed as trained exclusively on licensed data. Use this skill when a task asks for Marey or Moonvalley specifically, when a brief demands brand-safe / legally reviewed AI video for…
demo-shorts
Cut a vertical 9:16 Short (YouTube Shorts, Instagram Reels, TikTok) from a demo video project in one of four named styles — listicle (rapid numbered beats), cohost (split screen with presenter), flashcard (typographic interstitials), or glide (immersive pan). Use when the user asks for a "short", "shorts", "vertical…