Overcast provenance

Skill kdr/overcast/skills/overcast-provenance

Video OSINT agent: senses + OSINT reach for any agent.

Install

npx -y skills add kdr/overcast --skill overcast-provenance

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Trace a suspicious or viral clip back to its earliest appearance and originator — reverse-image-search distinctive frames, sweep sources with no recency floor, and return a cited origin verdict.

SKILL.md

4.4 KB, as published. Nobody here has run it

overcast-provenance

Use this skill to answer "is this clip real / where did it come from?": given a suspect video, find the oldest copy and who posted it first. It is the inverse of overcast-copycat-sweep — searching backward toward the origin rather than forward for rips — and reuses its geometry-gating and verdict conventions. This skill answers WHERE a clip came from (origin / earliest copy); for whether it was ALTERED (manipulation/authenticity — C2PA, EXIF re-save, ELA overlays, a shadow check) use the complementary overcast-verify-media. Origin and authenticity are distinct, non-overlapping questions — the leading verify/exif pass below establishes provenance signals, not a fakery verdict. Use the broad overcast skill and overcast/reference/verbs.md for exact flags.

Workflow

Check embedded provenance FIRST, then fingerprint the suspect clip. C2PA Content Credentials (verify) and EXIF capture metadata (exif) are the most direct origin evidence when present — a signed manifest names the creator + edit history. They're often stripped on re-upload, so also fingerprint distinctive frames (which survive the re-encodes, crops, and watermarks that defeat exact hashes AND that strip metadata):

overcast doctor --sources --json
overcast case init --json
overcast verify ./suspect.mp4 --json         # C2PA / Content Credentials: signer + edit manifest (needs c2patool)
overcast exif ./suspect.mp4 --json           # capture device/time, editing software, GPS (needs exiftool)
overcast watch ./suspect.mp4 --json          # content + transcript into memory
overcast index create origin --type image-ransac --local --json
overcast image add ./distinctive-frame.png --index <index-id> --json

Reverse-image-search the frames and sweep sources with topic keywords — crucially with NO --since floor, since older results sit closer to the origin:

overcast source add "lens:./distinctive-frame.png" --json
overcast source add "x:video:<topic keywords>" --json
overcast source add "youtube:search:<topic keywords>" --json
overcast source add "web:<topic keywords>" --json
overcast scan --limit 20 --json

Triage on metadata alone: sort candidate hits by published ASC — the earliest dates are your origin candidates; carry author + URL forward.
Capture the oldest few and confirm they are the SAME content (not a look-alike) — frame match plus transcript:

overcast capture <earliest-scan-hit-id> --json
overcast image match <captured-file> --index <index-id> --draw --json   # --draw writes the RANSAC overlay proof
overcast listen <captured-file> --json

Record the origin verdict. --ref the image match record so its overlay rides into the brief; ALWAYS leave a tldr note with the date chain — even "undetermined":

overcast finding create "origin: earliest confirmed copy is @<author> <date> (frame match 88 inliers, transcript identical); the viral <date2> post is a re-upload" --ref <image-match-record-id> --confidence high --json
overcast note "swept lens + x + youtube + web (no recency floor); <n> candidates; earliest confirmed <date> by @<author>; verdict: re-upload" --tag tldr --json
# Wait for the note result before exporting, so the TL;DR is included.
overcast brief --export ./provenance.html --json

Output

An origin verdict — original / re-upload-of-<earliest> / undetermined — with the date chain, the earliest confirmed poster and URL, which layers agreed (frame + transcript), and the strongest record.id + media.at citations. "Undetermined" is honest when the earliest copy can't be confirmed as the same content.

Caveats

The earliest date you FIND is a floor, not proof of origin — deleted posts and platforms you didn't search may predate it; say so. Confirm same-content with the gated image match (a high inlier count on a degenerate homography is the main false positive — eyeball the --draw overlay) plus transcript; a shared topic or a look-alike frame is not the same clip. Face similarity is 0–100; image match is an inlier count + a 0–1 ratio, never a 0–100 score. Apify sources bill per result. lens ignores --since.