The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes the official c2patool binary via Python's subprocess.Popen. This is the primary purpose of the skill and is implemented with safety controls:
It uses shell=False to prevent shell injection vulnerabilities.
It implements a custom _drain function with a memory ceiling to prevent Denial of Service (DoS) attacks from a verifier producing excessive output.
The resolve_tool function ensures that only valid executable paths are used.
[DATA_EXPOSURE]: The skill includes functionality to detect 'covert channels' in text, such as zero-width characters, homoglyphs, and Unicode tags. This is a security-enhancing feature designed to detect obfuscated content and prompt injections in assets rather than being a vulnerability itself.
[REMOTE_CODE_EXECUTION]: The skill allows for network access only when the --allow-network flag is explicitly provided by the user. This is used for fetching remote manifests or trust anchors, which are standard operations for C2PA verification. By default, network access is disabled.

verify-content-credentials