Skip to content
skillsafebeta
← Report library
Purpose / Other

Find The Original Image Skill Security Audit

What the author says it does (original text)

>-

Independent security check

Do not install or run it yet

Files checked
3
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Sensitive images may be disclosed to several commercial search providers

Source references: 4
What we found

The workflow calls for at least three engines and may upload the full original, multiple crops, and mirrored versions. Images can expose a client’s identity, face, documents, location, plates, or case details; every upload reveals both the submitted content and investigative interest to another provider. The Skill warns about this, but multi-engine searching remains the default workflow.

Why this matters

Providers may log, analyze, or retain images and query information under their own terms. Uploading to several platforms increases the number of organizations handling the data and may make the subject or purpose of an investigation easier to infer.

The source supports this risk. The default workflow calls for at least three external engines and sends the unmodified full image to every engine, followed by crops and mirrored versions. The Skill expressly acknowledges that uploading a client's image discloses it to a commercial vendor and may reveal the investigator's interest. The exposure occurs when an upload is actually made. Cropping can reduce some identifying detail, but the default full-image step can still disclose faces, IDs, or case details. A user can require sensitive material to default to no upload and require explicit approval before any full-image submission.

SKILL.md:40In the instructionsOpen original file
Run at least three. They disagree constantly, and that disagreement isinformation: TinEye finding an exact copy from years back while Lens finds onlyrecent reposts is the signature of recycled media.
Show 3 other places
SKILL.md:72In the instructionsOpen original file
2. **Full frame, all engines.** Cheap, sometimes instant.3. **Crop and re-search.** This is the highest-yield step in the whole skill. A   full frame's fingerprint is dominated by the background; crop tightly to the   face, the sign, the logo, the vehicle, the tattoo, the building corner, and   search each crop separately. Reposts get cropped and re-framed, so the crop   often matches when the frame does not.4. **Flip horizontally.** Mirroring is a routine way to dodge automated matching   and a routine artifact of screen-recording and video reposting. Flip and   re-run the same engines.5. **Preprocess and retry** on low-quality inputs — upscale, denoise, correct
SKILL.md:157In the instructionsOpen original file
  merely present.- **You may be leaking.** Uploading a client's image to a commercial engine  discloses it to that vendor and may deanonymise your interest. For sensitive  material, search a crop that omits identifying detail — or don't search. See  `investigate-without-getting-made`.
reference/preprocessing.md:170In the instructionsOpen original file
1. Metadata extraction and hashing (destructive edits come after, never before).2. Full frame, unmodified, to every engine.3. Crops of each distinctive element.4. Mirror of the frame and of the best crops.5. Upscale/denoise only what came back empty.6. OCR any text and pivot to a text search.
High risk

Face searches disclose biometric data and may violate law or service terms

Source references: 4
What we found

The Skill recommends PimEyes, FaceCheck.ID, or Search4Faces after Yandex fails. It states that facial templates are specially protected biometric data and that PimEyes positions its service for searching one’s own face; a third-party search may lack consent or another lawful basis.

Why this matters

An external service may process the subject’s face and connect it with names, social accounts, or other pages. Unauthorized use can invade privacy, misidentify an innocent person, and create risks of complaints, statutory damages, or terms-of-service violations in applicable jurisdictions.

The source supports a conditional risk, though the candidate omits important safeguards: the Skill lists dedicated face engines only after Yandex fails and expressly requires legal and consent issues to be cleared first. It also identifies facial templates as biometric data, says third-party PimEyes searches may violate its terms, and prohibits identifying strangers, protesters, or locating private people. The risk therefore arises chiefly if an operator ignores these limits or lacks documented authorization. A user can require a consent and lawful-basis check before submitting any third-party face and disable dedicated face engines by default.

SKILL.md:30In the instructionsOpen original file
|---|---|---|| A face | Yandex | Its index is built around facial similarity, so it returns different people who look alike *and* the same person in other photographs. No other general engine does this. || A face, and Yandex fails | A dedicated face engine (see below) | Only after you have cleared the legal and consent questions. || A street scene outside North America / Western Europe | Yandex | Deeply indexed Russian, Central Asian, Eastern European, Turkish and Chinese web content that Google under-crawls. |
Show 3 other places
SKILL.md:112In the instructionsOpen original file
PimEyes and FaceCheck.ID crawl the open web for faces and match on biometricsimilarity. They find people that no general engine will. They also carry realexposure:- A facial template is **biometric data** under GDPR Article 9 — a special  category needing an explicit lawful basis, not just a legitimate interest.  Illinois BIPA and Texas CUBI create private rights of action and statutory  damages for collecting biometric identifiers without written consent.- PimEyes' own terms position it as a tool to search for **your own** face and  offer an opt-out. Running a third party's face through it is against those  terms regardless of your intent.- Search4Faces indexes faces from Russian social platforms and is the practical
SKILL.md:126In the instructionsOpen original file
Use face search when you have a documented authorization or a legitimateprotective purpose — verifying a counterparty in a fraud case, identityverification with the subject's consent, missing-persons work, or checking yourown exposure. Do not use it to identify a stranger from a photo, to attach a nameto a face in a protest crowd, or to locate a private individual. Note in the casefile that you ran it and why. And treat a face-engine hit as **unconfirmed** onits own — look-alike false positives are common and the engine gives you noreasoning to audit.
SKILL.md:116In the instructionsOpen original file
- A facial template is **biometric data** under GDPR Article 9 — a special  category needing an explicit lawful basis, not just a legitimate interest.  Illinois BIPA and Texas CUBI create private rights of action and statutory  damages for collecting biometric identifiers without written consent.- PimEyes' own terms position it as a tool to search for **your own** face and  offer an opt-out. Running a third party's face through it is against those  terms regardless of your intent.- Search4Faces indexes faces from Russian social platforms and is the practical
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

The Skill submits an original image, crops, mirrored copies, or video keyframes to multiple reverse-image engines, then opens matching pages and uses dates, credits, captions, and archive records to assess the earliest verifiable publication.

View source
SKILL.md:67In the instructionsOpen original file
1. **Fix the input.** Get the highest-resolution copy you can — the file itself,   not a screenshot of it. Screenshots add a resize and a recompression that cost   you matches. Strip nothing yet; run `secrets-in-file-metadata` on the original   before you start editing copies.2. **Full frame, all engines.** Cheap, sometimes instant.
SKILL.md:72In the instructionsOpen original file
2. **Full frame, all engines.** Cheap, sometimes instant.3. **Crop and re-search.** This is the highest-yield step in the whole skill. A   full frame's fingerprint is dominated by the background; crop tightly to the   face, the sign, the logo, the vehicle, the tattoo, the building corner, and   search each crop separately. Reposts get cropped and re-framed, so the crop   often matches when the frame does not.4. **Flip horizontally.** Mirroring is a routine way to dodge automated matching   and a routine artifact of screen-recording and video reposting. Flip and   re-run the same engines.5. **Preprocess and retry** on low-quality inputs — upscale, denoise, correct
SKILL.md:82In the instructionsOpen original file
   levels. See [reference/preprocessing.md](reference/preprocessing.md).6. **For video**, extract keyframes and search them as stills. Search a frame   from the start, the middle and the end, plus any frame containing a sign or a   face. A keyframe hit is usually what breaks a video case.7. **Sort for oldest.** On TinEye, sort by oldest. Then treat that date as a   ceiling, not an answer, and go to step 8.8. **Read the match pages.** Open them. Harvest: photographer credit, agency,   caption, named people, on-page date, filename in the image URL (often   `2019-04-city-event-03.jpg`), and any surrounding article text. This is where   the selectors are.

The preprocessing guide says to preserve the original and use local tools such as ImageMagick, FFmpeg, and ExifTool to create crops, enhancements, and keyframe derivatives. It explicitly warns that learned upscalers invent detail and that text, plates, or facial detail from an upscale must not be treated directly as evidence.

View source
reference/preprocessing.md:3In the instructionsOpen original file
Every recipe below produces a *derivative* file. Keep the original untouched andhashed; work on copies with names that record what you did(`subject_crop-patch.png`, `subject_flop.png`). If your finding ends up in areport, you must be able to say what you fed each engine.
reference/preprocessing.md:68In the instructionsOpen original file
Caveat that matters: learned upscalers **hallucinate**. They invent plausibledetail. An upscaled image is a search aid only. Never read a licence plate, aface, or text off an upscaled image and treat it as evidence — go back to theoriginal pixels to confirm anything you think you see, and say in the report thatthe read came from the original, not the upscale.
Start here · InstructionsSKILL.md
find-the-original-image
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records3 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • reference/engine-matrix.mdFull text included
  • reference/preprocessing.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • reference/engine-matrix.mdSupporting file
  • reference/preprocessing.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
reference/engine-matrix.md:7In the instructionsOpen original file
- **Entry:** `https://yandex.com/images/` — upload or paste an image URL.- **Matching model:** learned visual similarity with a strong face component.
reference/engine-matrix.md:22In the instructionsOpen original file
- **Entry:** `https://lens.google.com/` — also reachable from the camera icon in  Google Images, and by right-clicking an image in Chrome.
reference/engine-matrix.md:39In the instructionsOpen original file
- **Entry:** `https://www.bing.com/images` — camera icon; upload, paste URL, or  drag.
Run commands
reference/preprocessing.md:13In the instructionsOpen original file
```bashmagick identify -verbose original.jpg | head -40   # dimensions, colourspace, quality estimate
reference/preprocessing.md:26In the instructionsOpen original file
```bashmagick original.jpg -crop 480x480+1220+640 +repage crop_patch.png
reference/preprocessing.md:44In the instructionsOpen original file
```bashmagick original.jpg -flop flop.jpg
Lines read
508
File checksum (to compare versions)
1a4ff9b86b5ef5c3439062efee79f65a0b604c261e28ba15961b5c5f86456ed0