Share-Safe Renders

Find out what a render leaks before you share it. Share-Safe Renders gives your agent one scanner for PNG, JPEG and MP4/MOV files and ComfyUI workflow JSON. It reports what people post by accident: API keys and secret-named fields, Discord and Slack webhook URLs, user names inside home-folder paths, e-mail addresses, LAN addresses, GPS coordinates, and secrets hidden where a text search does not look (bypassed ComfyUI nodes, JSON stored inside a string, compressed PNG chunks, hidden MP4 boxes).

Questions it answers

• Does this PNG, JPEG or MP4 carry a key, a webhook, a user name in a path, an e-mail address, a LAN address or GPS?
• Where exactly: which file, which container, which ComfyUI node, and was that node bypassed (it did not run, but its values are still saved)?
• Is anything hidden in a compressed PNG chunk, in JSON stored inside a string, or in an MP4 box that players and ffprobe do not show?
• Which files could not be scanned at all (damaged, too big, WebP or GIF), so nobody mistakes them for checked?
• After I re-export a copy without the metadata, does a second scan of the copy still find what was found?

How it works The skill is scan-first. scripts/scan.py only reads the files you give it: it never edits, moves or deletes them, and the one file it writes is the JSON report you name. The report never prints the text it found, only the class, the place, the length and a short keyed hash, so a file's metadata cannot put instructions into a report your agent reads. The skill then tells your agent how to export a copy without the metadata (ffmpeg and Pillow commands, run on synthetic files and labelled per build) and to check the copy by scanning it again; another program makes the copy and the scanner checks it, so the check is not circular. The skill tells the agent to give a fixed report: verdict first, then findings, then how to fix, then what the scan cannot see. A file or folder name can contain text that a shell runs, so the skill tells the agent to paste a file name into a command only if the name is plain (ASCII letters, digits, spaces and . _ ( ) + -), and only if the folder you name has no ", $, backtick, %, ! or typographic double quote in it; for any other name it tells the agent to ask you to copy or rename the file, or move it to a plain-named folder, first.

Honest by design A file the scanner could not scan is not reported as clean: it is listed under COULD NOT FULLY SCAN and the run exits 3 when nothing else was found (1 if another file has a finding). Links and file types it does not read, met inside a folder, are skipped, counted and named under NOTES. A run that scanned no file at all exits 3. No verdict line the skill gives the agent says "clean" or "safe", and it tells the agent never to say a file is fine to share. "Nothing found" is not a guarantee: the known misses are written down (data hidden in pixels or in the compressed image and video streams, the contents of C2PA manifests, secrets that were split or re-encoded, vendor key formats outside its list of eight vendors, webhooks of providers other than Discord and Slack). It does not judge your prompt text or what the picture shows.

It does not replace exiftool or trufflehog. exiftool shows more tags than this scanner reads; trufflehog has far more vendor detectors and can check whether a key is live. What this adds is classification (paths, e-mail addresses, LAN addresses, GPS, hidden MP4 boxes), node and bypassed-node attribution, decoding of compressed PNG chunks, a report that never prints the leaked text, and an exit code that does not read a file it knows it could not scan as clean. In a head-to-head on a synthetic corpus (240 files, 194 planted entries; exiftool 13.59, trufflehog 3.99.2), trufflehog scanned none of the real PNG, JPEG or MP4 files as shipped (the only two files it scanned were a text file and random bytes named .png) and, with workarounds, flagged 27 of 68 planted key entries (the scanner: 68 of 68); exiftool's dumps showed 189 of the 194 entries in clear text and classified none. Much of that gap is the shape of the corpus: counted by underlying key, the report lists 32 OpenAI-legacy keys (trufflehog flagged 1; only 1 of the corpus's 43 OpenAI-legacy values has the marker it needs) and 7 lone AWS key ids it never reports, and excluding OpenAI-legacy values and lone AWS key ids trufflehog flagged 33 of the 40 remaining effective K1 entries (82%), a count on a different basis from the 27 of 68. The scanner matched 194 of 194, but 91 of those 194 are classes trufflehog has no detector for, and the scanner was built against that corpus, so that is not an estimate of real-world recall. The numbers and every caveat are in the package.

What is inside One scanner (scan.py, standard library only), a demo-file maker (make_demo.py) that writes six synthetic files with invented secrets, five reference notes (what leaks and where, how to export a copy, reading the report, known misses, the comparison), a real sample report in Markdown and JSON, and an example session that includes a run that cannot scan everything. A sixth note (references/no-skill-folder.md) is for an agent that receives the skill as text with no skill folder: it names the one file a scan needs (scan.py, about 145 KB) and gives a short program that writes each file the agent loads into a fresh folder in the system temp folder only when its SHA-256 is the published one, and checks that folder before anything runs.

Requirements Python 3.9 or newer. ffmpeg is needed only for the export commands and the demo MP4; ffprobe is optional. The 692 automated tests ran on Windows 11 and on Linux in Docker (see the compatibility note). They live in the public repository and are not in the zip. Not tested: macOS, and any agent end to end. Free.

Source and licence Source code and tests: https://github.com/sawizzle/share-safe-renders (MIT OR Apache-2.0). The copy you get through Agensi is under Agensi's buyer terms (a personal, non-transferable licence).