secrets-in-file-metadata

Extract and interpret EXIF, XMP, IPTC, and document metadata from images, Office files, and PDFs.

38|2|Updated Aug 2, 2026
One-click install
npx skills add https://github.com/UseOSINT/Skills --skill secrets-in-file-metadata-useosint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-in-file-metadata
Source: https://github.com/UseOSINT/Skills/tree/main/skills/secrets-in-file-metadata
Command: npx skills add https://github.com/UseOSINT/Skills --skill secrets-in-file-metadata-useosint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Files carry hidden metadata — GPS coordinates, camera serial numbers, document authors, template paths, and editing history — that investigators and analysts routinely miss or misread. This Skill turns exiftool output into reliable findings by teaching which tags matter, where tools lie, and how to grade confidence in each claim. ## Core Features & Use Cases - Full metadata extraction: Run exiftool with the correct flags (-G1, -a, -u, -n) on JPEG, HEIC, RAW, MP4, DOCX, XLSX, and PDF files, plus bulk CSV triage across whole directories. - High-value field interpretation: Read GPS coordinates and camera bearing, device serial numbers for link analysis, timezone-anchored timestamps, editing chains, and embedded thumbnails that reveal pre-crop content. - Document forensics: Unzip Office containers to expose tracked-change authors, comment identities, template UNC paths, and embedded images with intact EXIF; parse PDFs for producer strings, incremental revisions, and failed redactions. - Use Case: Verify an insurance-claim PDF allegedly written on-site: discover it was produced by a word processor, find a DOCX whose template path leaks a third-party firm's server, and extract an embedded photo whose EXIF date contradicts the claimed inspection date. ## Quick Start Use the secrets-in-file-metadata skill to extract and interpret all metadata from the attached photo and tell me where and when it was taken and on what device.

Frequently Asked Questions about secrets-in-file-metadata

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract EXIF metadata and GPS coordinates from a photo?▼

Run exiftool with -G1 -a -u -g1 for a full grouped dump, or -gps:all -n to get GPS as signed decimal coordinates ready for mapping. The -G1 flag distinguishes device-written tags from exiftool's calculated Composite values.

How do I find the author of a DOCX or PDF document?▼

exiftool surfaces Author, LastModifiedBy, Company, and Template fields from Office and PDF files. For DOCX, also unzip the container and read docProps/core.xml, word/comments.xml, and tracked changes in word/document.xml, which carry per-author names and dates.

Why does my photo have no EXIF data after downloading from social media?▼

Large social platforms re-encode images to generate delivery renditions, which discards EXIF. Forums, self-hosted CMSes, and direct file links often serve original bytes with metadata intact, so try to reach the original upload path instead.

Can EXIF timestamps be trusted as evidence?▼

Not alone. EXIF datetimes carry no timezone and camera clocks drift or stay on the wrong zone after travel. Anchor them against the UTC GPSDateTime tag or a dated event visible in frame before relying on any timestamp.

How do I detect if a photo or PDF has been edited or manipulated?▼

Check Software and CreatorTool tags for editors, compare the embedded thumbnail against the main image for pre-crop content, and look for timestamps that disagree across EXIF and XMP blocks. For PDFs, a word-processor Producer on a claimed scan is a strong tell.

Is it safe to use online EXIF viewer tools for sensitive files?▼

No. Online metadata viewers require uploading your evidence to a third-party server, where it may be retained or indexed. Install exiftool locally — it runs fully offline and is the standard for evidence handling.