'Admittedly hard to see here, but what's happening is this. Keymaster is running in the background. A screenshot is taken. Keymaster has, by this point, already reset the file's permissions to read-only and cleansed the file of all extended attributes. Normally, when Preview opens a screenshot file to save it again to disk, after prompting to have the file 'unlocked' as Keymaster's already been at work on it, there'll be a new shipload of extended attributes. But not now, not with Keymaster running! You can also see - if you look closely in full-screen at the file info sheet - that Keymaster has again reset the file's permissions to read-only (0400).
Stockholm/London-based Rixstep are a constellation of programmers and support staff from Radsoft Laboratories who tired of Windows vulnerabilities, Linux driver issues, and cursing x86 hardware all day long. Rixstep have many years of experience behind their efforts, with teaching and consulting credentials from the likes of British Aerospace, General Electric, Lockheed Martin, Lloyds TSB, SAAB Defence Systems, British Broadcasting Corporation, Barclays Bank, IBM, Microsoft, and Sony/Ericsson.
Rixstep and Radsoft products are or have been in use by Sweden's Royal Mail, Sony/Ericsson, the US Department of Defense, the offices of the US Supreme Court, the Government of Western Australia, the German Federal Police, Verizon Wireless, Los Alamos National Laboratory, Microsoft Corporation, the New York Times, Apple Inc, Oxford University, and hundreds of research institutes around the globe. See here.