Video To Gif

title: Video-to-GIF Skill Security Model description: STRIDE threat model for the video-to-gif skill organized by assets, adversaries, and trust buckets (CLI to FFmpeg subprocess, untrusted media parsing, CLI caller process and filesystem) with in-code mitigations and acknowledged enterprise readiness gaps author: microsoft/hve-core ms.date: 2026-09-27 ms.topic: reference estimated_reading_time: 9 keywords:

• security

• STRIDE

• video-to-gif

• ffmpeg

• threat model

<!-- markdownlint-disable-file -->

Video-to-GIF Skill Security Model

This document records the STRIDE threat model for the video-to-gif skill (scripts/convert.sh and scripts/convert.ps1, the POSIX and PowerShell twins). The model is organized by trust bucket: CLI → FFmpeg/ffprobe subprocess (B1), Untrusted media input parsing (B2), and CLI caller process and filesystem (B3). Each bucket enumerates all six STRIDE categories with the in-code mitigations that address them. Assets and adversaries are enumerated first. Acknowledged enterprise readiness gaps are listed at the end.

The skill is a local media converter. It resolves a video filename, invokes ffprobe to detect HDR metadata, and runs one (single-pass) or two (palette + paletteuse) ffmpeg invocations to produce an optimized GIF. It handles no credentials, opens no local listener, and performs no network egress; both twins run entirely with the caller's privileges against local files.

See also: repo-wide STRIDE model. This skill participates in the repository-wide threat model at docs/security/security-model.md and is registered in its Skill Security Models section.

Executive Summary

The video-to-gif skill converts an untrusted local video into a GIF by shelling out to FFmpeg. Its highest-risk behavior is parsing untrusted media: the input file's container and codec bitstreams are decoded by FFmpeg, which inherits FFmpeg's decoder CVE exposure. The skill constructs every FFmpeg argument as an array element (no shell string interpolation), validates all numeric parameters before they enter the FFmpeg -vf filtergraph (closing a filtergraph-injection vector), allow-lists the dither and tonemap algorithms, isolates the intermediate palette in a private unpredictable temp directory, and bounds every FFmpeg/ffprobe invocation with a wall-clock timeout. Residual risk concentrates in FFmpeg's own memory safety when decoding hostile media, which the skill cannot fix and bounds only for denial of service.

Security Posture Overview

Contents

• System Description

• Trust Boundaries

• Assets

• Adversaries

• Bucket B1: CLI → FFmpeg/ffprobe subprocess

• Bucket B2: Untrusted media input parsing

• Bucket B3: CLI caller process and filesystem

• Enterprise Readiness Gaps

• References

System Description

Components

1. scripts/convert.sh — POSIX/bash twin: resolves the input file, detects HDR via ffprobe, validates parameters, and runs bounded single-pass or two-pass ffmpeg conversions.

2. scripts/convert.ps1 — PowerShell twin with the same behavior, using typed [ValidateRange]/[ValidateSet] parameters and a .NET process wrapper for bounded execution.

3. tests/convert.Tests.ps1 — Pester unit tests that mock the FFmpeg execution seam.

Data Flow

flowchart TD
    subgraph HOST["Operator Workstation / Runner (trust zone)"]
        CLI["convert.sh / convert.ps1"]
        INPUT["Untrusted video file"]
        TMP["Private temp dir<br/>(mkdtemp / random, 0700)"]
        OUT["Output GIF"]
    end
    subgraph TOOLS["FFmpeg toolchain (subprocess, same host)"]
        FFPROBE["ffprobe<br/>(HDR metadata)"]
        FFMPEG["ffmpeg<br/>(decode + palette)"]
    end
    CLI -->|"validated args (array, no shell), bounded by timeout"| FFPROBE
    CLI -->|"validated args (array, no shell), bounded by timeout"| FFMPEG
    INPUT -->|"untrusted bitstream"| FFPROBE
    INPUT -->|"untrusted bitstream"| FFMPEG
    FFMPEG -->|"writes palette"| TMP
    FFMPEG -->|"writes"| OUT

Trust Boundaries

Boundary Diagram

┌───────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY: Operator Workstation / Runner             │
│  ┌─────────────┐   ┌──────────────┐   ┌────────────────┐  │
│  │ convert.sh  │   │ Private temp │   │ Output GIF     │  │
│  │ convert.ps1 │   │ dir (0700)   │   │                │  │
│  └─────────────┘   └──────────────┘   └────────────────┘  │
└───────────────────────────┬───────────────────────────────┘
                            │ process boundary (array args, no shell)
        ┌────────────────────▼────────────────────┐
        │ TRUST BOUNDARY: FFmpeg subprocess        │
        │  ┌────────────────────────────────────┐  │
        │  │ ffprobe / ffmpeg decode untrusted  │  │
        │  │ container + codec bitstreams       │  │
        │  └────────────────────────────────────┘  │
        └──────────────────────────────────────────┘

Boundary Descriptions

Assets

Adversaries

Bucket B1: CLI → FFmpeg/ffprobe subprocess

Spoofing

• ffmpeg and ffprobe are resolved by name from PATH; the skill trusts the operator's environment for binary identity. A compromised PATH is an inherited environment concern, not one the skill can resolve; operators are expected to maintain PATH hygiene.

Tampering

• All FFmpeg arguments are passed as discrete array elements (bash "${args[@]}", PowerShell ProcessStartInfo.ArgumentList), never as a shell string, so no argument can inject shell metacharacters.

• Numeric parameters (fps, width, loop, start, duration) are validated to integer/decimal ranges before they are interpolated into the FFmpeg -vf filtergraph, closing a filtergraph-injection vector (V-INJ-1, mitigated). The PowerShell twin enforces the same ranges through typed [ValidateRange] parameters.

• Dither and tonemap algorithms are restricted to fixed allow-lists (bash case, PowerShell [ValidateSet]).

Repudiation

• Not applicable. This is a local developer conversion tool with no audit or non-repudiation requirement. FFmpeg progress is written to stderr for the interactive caller.

Information Disclosure

• No secrets or credentials are handled and no network egress occurs. FFmpeg output is limited to progress and diagnostics on the caller's terminal.

Denial of Service

• Every ffprobe and ffmpeg invocation is bounded by a wall-clock timeout (bash timeout/gtimeout, PowerShell Process.WaitForExit + Kill through Invoke-BoundedProcess), default 600 seconds and overridable via VIDEO_TO_GIF_TIMEOUT / -TimeoutSeconds (V-DOS-1, mitigated). A timed-out or failed HDR probe is treated as SDR input rather than aborting. A pathological input can still consume CPU and disk within the bound.

Elevation of Privilege

• The subprocess runs with the caller's privileges and no shell (UseShellExecute=$false; array argument passing). There is no privilege transition.

Risk Rating

Bucket B2: Untrusted media input parsing

Spoofing

• Not applicable. The input file is treated as untrusted data, never as an authenticated identity.

Tampering

• The skill never modifies the input file; FFmpeg opens it read-only. The untrusted container and codec bitstreams are parsed by FFmpeg's demuxers and decoders.

Repudiation

• Not applicable. No audit requirement for a local conversion.

Information Disclosure

• ffprobe reads only color_primaries and color_transfer for HDR detection; no other metadata from the untrusted file is surfaced beyond an HDR yes/no decision.

Denial of Service

• A malformed or oversized input could stall decoding; both the HDR probe and each conversion pass are bounded by the wall-clock timeout (V-DOS-1).

Elevation of Privilege

• Memory-safety defects in FFmpeg's decoders, triggered by hostile media, could theoretically execute code within the FFmpeg process. The skill cannot fix FFmpeg internals; the timeout bounds availability impact but not memory-safety exploitation. This is recorded as G-SUP-1, mitigated at the operator level by keeping FFmpeg patched.

Risk Rating

Bucket B3: CLI caller process and filesystem

Spoofing

• Not applicable. No authentication or identity surface.

Tampering

• The intermediate palette is written inside a private, unpredictable temporary directory (bash mktemp -d ... 0700, PowerShell random directory under the system temp path) rather than a predictable /tmp/palette_$$.png or %TEMP%\palette_$PID.png, closing a symlink/pre-creation race on a shared temp location (V-TMP-1, mitigated). Cleanup runs on process exit (a bash EXIT handler bound to a script-global path so it still resolves after main returns or set -e unwinds it; PowerShell finally) so the directory is removed on success, failure, and timeout.

Repudiation

• Not applicable. Local tool with no non-repudiation requirement.

Information Disclosure

• The convenience file search resolves a bare filename across the current directory, the workspace root, and ~/Movies/~/Videos, ~/Downloads, and ~/Desktop. A bare name could resolve to an unintended file in a lower-priority location (G-INF-1); the bash prefix fallback matches the requested name literally, so glob characters in it are not expanded. The output path is derived from the input, existing destinations are overwritten with -y, and an output that resolves to the input path is refused before any FFmpeg call so the source cannot be overwritten.

Denial of Service

• Temp and output writes are bounded by the conversion timeout; disk usage is proportional to the input size.

Elevation of Privilege

• The skill runs entirely with the caller's privileges; there is no setuid behavior and no elevation.

Risk Rating

Enterprise Readiness Gaps

The following are known limitations recorded so operators can make informed deployment decisions. Severity ratings are the project's own assessment and are not equivalent to a CVSS score.

For an active issue tracker entry covering these gaps, see the hve-core issues list.

References

• STRIDE Threat Model

• OWASP Top 10

• FFmpeg Security

• Repository security model

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.