跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Find The Original Image Skill 安全审计

作者说它能做什么（原文）

>-

第三方安全检查结论

先别安装或运行

已检查文件
3
发现的风险
2
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
高风险

敏感图片可能被披露给多个商业搜索服务

原文依据：4 处
发现了什么

流程要求至少使用三个引擎，并会上传完整原图、多个局部裁剪和镜像版本。图片可能包含客户身份、面孔、证件、位置、车牌或案件细节；每次上传都会把相应内容及调查兴趣暴露给外部服务商。Skill 虽然警告了这一点，但主流程仍默认多引擎搜索。

为什么需要注意

服务商可能按其条款记录、分析或保留图片和查询信息；多平台上传扩大了接触数据的机构数量，也可能使调查对象或案件关联更容易被推断。

该风险有源码支持。默认流程要求至少运行三个外部引擎，并把未修改的完整图片提交给每个引擎，随后还会搜索裁剪和镜像版本。Skill 明确承认，上传客户图片会向商业服务商披露内容，并可能暴露调查者的关注对象。风险发生在用户实际上传图片时；裁剪可以减少部分识别信息，但完整原图的默认步骤仍可能暴露人脸、证件或案件细节。用户可要求作者把敏感材料改为默认不上传，并在任何完整原图上传前取得明确批准。

SKILL.md:40来自说明文档打开原文件
Run at least three. They disagree constantly, and that disagreement isinformation: TinEye finding an exact copy from years back while Lens finds onlyrecent reposts is the signature of recycled media.
查看另外 3 个位置
SKILL.md:72来自说明文档打开原文件
2. **Full frame, all engines.** Cheap, sometimes instant.3. **Crop and re-search.** This is the highest-yield step in the whole skill. A   full frame's fingerprint is dominated by the background; crop tightly to the   face, the sign, the logo, the vehicle, the tattoo, the building corner, and   search each crop separately. Reposts get cropped and re-framed, so the crop   often matches when the frame does not.4. **Flip horizontally.** Mirroring is a routine way to dodge automated matching   and a routine artifact of screen-recording and video reposting. Flip and   re-run the same engines.5. **Preprocess and retry** on low-quality inputs — upscale, denoise, correct
SKILL.md:157来自说明文档打开原文件
  merely present.- **You may be leaking.** Uploading a client's image to a commercial engine  discloses it to that vendor and may deanonymise your interest. For sensitive  material, search a crop that omits identifying detail — or don't search. See  `investigate-without-getting-made`.
reference/preprocessing.md:170来自说明文档打开原文件
1. Metadata extraction and hashing (destructive edits come after, never before).2. Full frame, unmodified, to every engine.3. Crops of each distinctive element.4. Mirror of the frame and of the best crops.5. Upscale/denoise only what came back empty.6. OCR any text and pivot to a text search.
高风险

人脸搜索会向外部服务披露生物识别数据，并可能违反法律或平台条款

原文依据：4 处
发现了什么

该 Skill 推荐在 Yandex 失败后使用 PimEyes、FaceCheck.ID 或 Search4Faces。它自己说明人脸模板属于特殊类别的生物识别数据，而且 PimEyes 的条款把服务定位为搜索本人面孔；第三方人脸查询可能缺少同意或合法依据。

为什么需要注意

被搜索者的面部数据可能被外部服务处理并关联到姓名、社交账户或其他网页。未经授权的使用可能侵害隐私、错误识别无辜者，并在适用地区带来投诉、法定赔偿或违反服务条款的风险。

源码支持一种有条件的风险，但候选描述遗漏了重要保护措施：Skill 只把专用人脸引擎列为 Yandex 失败后的选择，并明确要求先处理法律和同意问题。它也说明人脸模板属于生物识别数据，第三方 PimEyes 查询可能违反条款，并禁止用其识别陌生人、抗议者或定位私人个体。因此，风险主要在操作者忽视这些限制或缺乏可记录授权时成立。用户可要求在提交任何第三方人脸前进行同意和合法依据检查，并禁用专用人脸引擎作为默认步骤。

SKILL.md:30来自说明文档打开原文件
|---|---|---|| A face | Yandex | Its index is built around facial similarity, so it returns different people who look alike *and* the same person in other photographs. No other general engine does this. || A face, and Yandex fails | A dedicated face engine (see below) | Only after you have cleared the legal and consent questions. || A street scene outside North America / Western Europe | Yandex | Deeply indexed Russian, Central Asian, Eastern European, Turkish and Chinese web content that Google under-crawls. |
查看另外 3 个位置
SKILL.md:112来自说明文档打开原文件
PimEyes and FaceCheck.ID crawl the open web for faces and match on biometricsimilarity. They find people that no general engine will. They also carry realexposure:- A facial template is **biometric data** under GDPR Article 9 — a special  category needing an explicit lawful basis, not just a legitimate interest.  Illinois BIPA and Texas CUBI create private rights of action and statutory  damages for collecting biometric identifiers without written consent.- PimEyes' own terms position it as a tool to search for **your own** face and  offer an opt-out. Running a third party's face through it is against those  terms regardless of your intent.- Search4Faces indexes faces from Russian social platforms and is the practical
SKILL.md:126来自说明文档打开原文件
Use face search when you have a documented authorization or a legitimateprotective purpose — verifying a counterparty in a fraud case, identityverification with the subject's consent, missing-persons work, or checking yourown exposure. Do not use it to identify a stranger from a photo, to attach a nameto a face in a protest crowd, or to locate a private individual. Note in the casefile that you ran it and why. And treat a face-engine hit as **unconfirmed** onits own — look-alike false positives are common and the engine gives you noreasoning to audit.
SKILL.md:116来自说明文档打开原文件
- A facial template is **biometric data** under GDPR Article 9 — a special  category needing an explicit lawful basis, not just a legitimate interest.  Illinois BIPA and Texas CUBI create private rights of action and statutory  damages for collecting biometric identifiers without written consent.- PimEyes' own terms position it as a tool to search for **your own** face and  offer an opt-out. Running a third party's face through it is against those  terms regardless of your intent.- Search4Faces indexes faces from Russian social platforms and is the practical
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 的核心流程是把原图、裁剪图、镜像图或视频关键帧提交给多个反向图片搜索引擎，再打开匹配页面，依据日期、署名、说明文字和存档记录判断最早可确认的发布来源。

查看原文
SKILL.md:67来自说明文档打开原文件
1. **Fix the input.** Get the highest-resolution copy you can — the file itself,   not a screenshot of it. Screenshots add a resize and a recompression that cost   you matches. Strip nothing yet; run `secrets-in-file-metadata` on the original   before you start editing copies.2. **Full frame, all engines.** Cheap, sometimes instant.
SKILL.md:72来自说明文档打开原文件
2. **Full frame, all engines.** Cheap, sometimes instant.3. **Crop and re-search.** This is the highest-yield step in the whole skill. A   full frame's fingerprint is dominated by the background; crop tightly to the   face, the sign, the logo, the vehicle, the tattoo, the building corner, and   search each crop separately. Reposts get cropped and re-framed, so the crop   often matches when the frame does not.4. **Flip horizontally.** Mirroring is a routine way to dodge automated matching   and a routine artifact of screen-recording and video reposting. Flip and   re-run the same engines.5. **Preprocess and retry** on low-quality inputs — upscale, denoise, correct
SKILL.md:82来自说明文档打开原文件
   levels. See [reference/preprocessing.md](reference/preprocessing.md).6. **For video**, extract keyframes and search them as stills. Search a frame   from the start, the middle and the end, plus any frame containing a sign or a   face. A keyframe hit is usually what breaks a video case.7. **Sort for oldest.** On TinEye, sort by oldest. Then treat that date as a   ceiling, not an answer, and go to step 8.8. **Read the match pages.** Open them. Harvest: photographer credit, agency,   caption, named people, on-page date, filename in the image URL (often   `2019-04-city-event-03.jpg`), and any surrounding article text. This is where   the selectors are.

预处理说明要求保留原件，并用 ImageMagick、FFmpeg、ExifTool 等本地命令生成裁剪、增强和关键帧衍生文件。它还明确警告 AI 放大会虚构细节，不能把放大图中的文字、车牌或面部细节直接当作证据。

查看原文
reference/preprocessing.md:3来自说明文档打开原文件
Every recipe below produces a *derivative* file. Keep the original untouched andhashed; work on copies with names that record what you did(`subject_crop-patch.png`, `subject_flop.png`). If your finding ends up in areport, you must be able to say what you fed each engine.
reference/preprocessing.md:68来自说明文档打开原文件
Caveat that matters: learned upscalers **hallucinate**. They invent plausibledetail. An upscaled image is a search aid only. Never read a licence plate, aface, or text off an upscaled image and treat it as evidence — go back to theoriginal pixels to confirm anything you think you see, and say in the report thatthe read came from the original, not the upscale.
从这里开始 · 工作说明SKILL.md
find-the-original-image
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。

文件引用关系图

2 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录3 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • reference/engine-matrix.md已纳入全文
  • reference/preprocessing.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • reference/engine-matrix.md配套文件
  • reference/preprocessing.md配套文件

代码和说明中提到的操作

连接外部网站
reference/engine-matrix.md:7来自说明文档打开原文件
- **Entry:** `https://yandex.com/images/` — upload or paste an image URL.- **Matching model:** learned visual similarity with a strong face component.
reference/engine-matrix.md:22来自说明文档打开原文件
- **Entry:** `https://lens.google.com/` — also reachable from the camera icon in  Google Images, and by right-clicking an image in Chrome.
reference/engine-matrix.md:39来自说明文档打开原文件
- **Entry:** `https://www.bing.com/images` — camera icon; upload, paste URL, or  drag.
运行命令
reference/preprocessing.md:13来自说明文档打开原文件
```bashmagick identify -verbose original.jpg | head -40   # dimensions, colourspace, quality estimate
reference/preprocessing.md:26来自说明文档打开原文件
```bashmagick original.jpg -crop 480x480+1220+640 +repage crop_patch.png
reference/preprocessing.md:44来自说明文档打开原文件
```bashmagick original.jpg -flop flop.jpg
读取了多少行
508
文件校验值（用于核对版本）
1a4ff9b86b5ef5c3439062efee79f65a0b604c261e28ba15961b5c5f86456ed0