media-security-report

name	media-security-report
description	Prepare, reproduce, and audit standalone upstream security reports for the third-party media libraries Firefox vendors — FFmpeg/ffvpx, libvpx, libaom, dav1d, the Xiph libraries, libpng, libjpeg-turbo, libsoundtouch, libsrtp, libwebrtc, libyuv, libwebp, nestegg, cubeb, mp4parse-rust and the in-tree components with no upstream. Works out which private channel the library actually has, reproduces on the vendored revision, traces the root cause with revision-pinned links, exports git-formatted patches, and drafts the submission without ever sending it. Triggers on: "/media-security-report", "report this to [e-mail]", "prepare an upstream security report", "how do I report this <library> bug privately", "is this <library> crash security-relevant", "audit this security report".
argument-hint	<evidence-path-or-claim> [--library <id>] [--firefox <path>] [--report-dir <path>] | --audit <report.md> --library <id>
allowed-tools	["Bash","Read","Write","Edit","Grep","Glob","AskUserQuestion","WebFetch","TaskCreate","Agent","Skill"]

Media Security Report

Purpose

Produce a self-contained report that the library's own maintainer can reproduce without any Firefox context, and route it to the private channel that library actually has. Treat the original bug report as evidence to verify, not as the root cause.

Only FFmpeg and libjpeg-turbo publish required-contents lists, so the report body is the same everywhere — report-core.md. What varies per library is the channel, the confidentiality mechanics, and how the crash input travels: channel-profiles.md and library-policies.md.

Follow the source-permalinks skill for every revision-pinned link.

Arguments: $0

Parse the arguments; do not guess a missing path:

• --audit <path.md> --library <id> → audit mode. Skip to Step 6.
• --library <id> → library id or a tree path (media/libdav1d works).
• --firefox <path> → checkout root. Default: walk up from cwd, since this skill is symlinked into each worktree's .claude/skills/.
• --report-dir <path> → where the report and artifacts go.
• Remaining token: an existing directory or file → the evidence; otherwise a freeform claim to verify.
• Anything still unresolved → ask with AskUserQuestion.

Create one task per step with TaskCreate on a fresh run. A report spans several long builds; the task list is what tells a resumed session which steps already have evidence on disk.

Guardrails

• Never send, file, email, or submit. Prepare the report and the submission draft; the user does the rest. This includes never opening a prefilled tracker URL in a way that creates the item.
• Fail closed on routing. A library with no policy row routes to a Bugzilla security bug with no external CC. Guessing an upstream security address is the one mistake that discloses a live vulnerability.
• Crash-input delivery is the channel's decision, not yours. Attaching a file to a confidential GitLab issue in a public project makes it world-readable. Follow the profile.
• Verify the issue is real, security-relevant, and reproducible. Do not send automated false positives, ordinary bugs, non-exploitable undefined behavior, or leaks to a security address. Several projects ban accounts for this.
• Never invent reviewer or finder identities, CVEs, generators, stack frames, introducing commits, or exploitability claims. Record Unknown, Not available, or Not applicable with a reason, and use AskUserQuestion when a human attribution is required.
• Never invent a revision either. When the tree does not record one, say so.
• Preserve user changes. Never reset or clean a dirty tree destructively; use a fresh clone or a separate worktree. Inspect any existing worktree first.
• Keep the vulnerable, latest-upstream, and fixed revisions distinct. A successful run on latest master does not prove the vendored revision was affected.
• Delegate research, never verdicts. A subagent gathers stacks, traces and history; the main agent decides what is verified and where the report goes.
• Record the channel's known unknowns rather than resolving them by assumption.

Inputs and output layout

• EVIDENCE_DIR: the supplied bug report, attachments, logs, existing patches.
• UPSTREAM_WORKTREE: a dedicated clone of the library, used only for this report.
• REPORT_DIR: the report and its artifacts.

REPORT_DIR/
  <library>-security-report.md
  submission-draft.md                       # ready to paste; never sent
  01-test-<unique-name>.patch
  02-fix-<unique-name>.patch
  input-<unique-name>.<ext>                 # if the channel takes attachments
  generate-<unique-name>.<sh|py>            # if available
  stack-<unique-name>.log                   # optional, cited by the report
  research/                                 # working notes, never submitted
    repro-matrix.md
    code-path.md
    history.md
    audit.md

Never reuse a generic name such as input.bin or crash.log. Preserve the source extension and give every artifact a report-specific unique name.

Subagent delegation policy

Main-agent context is reserved for synthesis: the security-relevance decision, the routing decision, separating verified facts from assumptions, and the report wording.

Delegate with Agent when a task is bounded, voluminous, or parallelisable. Each subagent writes to its own file under REPORT_DIR/research/ and returns a short summary plus that path. Once the revision is pinned (Step 2), issue these as multiple Agent calls in a single message:

• Repro runner → research/repro-matrix.md. Builds and runs the vendored, latest-upstream and fixed revisions; records compiler, configure flags, platform, thread count, round count, command line, exit/signal status, and symbolized stacks.
• Code-path tracer → research/code-path.md. Reads every function in the claimed call path at the pinned revision and drafts the numbered trace with revision-pinned links.
• History archaeologist → research/history.md. git log -S, git log -G, git blame, parent comparison; reports what was checked when inconclusive.

Never delegate: which channel the report goes to, whether the issue is security-relevant, the fix design, or any claim that the issue reproduces.

Workflow

0. Identify the library and route

python3 .claude/skills/media-security-report/scripts/media_lib_facts.py --library <id>

Read the library's row in library-policies.md and its channel section in channel-profiles.md, then print a routing block and confirm it with the user before doing any work:

Library:      <id>            (paths: <tree paths>)
Revision:     <ref> (<kind>)  <- <where the tree records it>
Repository:   <url> [<forge>]
Bugzilla:     <product> :: <component>  <- <where that came from>
Channel:      <profile>  →  <intake>
Secondary:    <… or none>
Crash input:  <attach | inline base64 | encrypted attachment | unverified>
One-shot:     <the irreversible step, or none>
Test harness: <framework> — <where its tests live>

Gate: if the library has no upstream (has_upstream: false — libmkv, openmax_il, mozva, psshparser, gmp-clearkey, wmf-clearkey), stop the upstream workflow here. The deliverable becomes a Bugzilla security bug with no external CC, reproduction is a Firefox test, and the code is cited with revision-pinned searchfox links.

If the tool reports an assumed Bugzilla component, verify it before filing: ./mach file-info bugzilla-component <path>.

1. Intake and evidence inventory

• Read the supplied report and list every claimed manifestation, input, command or API sequence, build mode, stack, patch, and observed result. Inspect attachments and logs directly with Read; do not rely on a summary when the source evidence is available.
• Identify the human reviewer(s) who will stand behind the verification and the human finder(s) to credit. Ask with AskUserQuestion; a bot is not a human reviewer. In the same question, capture whether and where AI was used — never assume, and never answer it on the user's behalf.
• Separate facts from assumptions. Mark anything still needing a run, source read, or symbolized stack as pending.
• Decide whether the issue belongs at this library's security channel, against that library's scope gate where it has one (libjpeg-turbo's is explicit). If it is an ordinary bug, say so and stop.

2. Pin and prepare the source

• Clone from the repository URL the routing block printed — not from origin.url in moz.yaml, which is often just the project homepage.

• Check out the vendored revision. Confirm the tree and hash before each run:

  git -C UPSTREAM_WORKTREE status --short
  git -C UPSTREAM_WORKTREE rev-parse HEAD
  

• When the tree pins a tag, record both the tag and the hash it resolves to, and cite the hash in the trace. When it records a short hash (libwebrtc), say so rather than padding it out.

• List the library's local Firefox patches; a defect may be Mozilla's, not upstream's. The facts tool prints them.

• Cite code with the forge template the facts tool printed, always pinned.

3. Reproduce the issue and the fix

Hand the matrix to the repro-runner subagent when the builds are long, then read research/repro-matrix.md before making any reproduction claim.

• Start with the smallest command or API sequence that exercises the issue. A custom harness is fine when it is complete and easy to build. Build/test hints per library are in library-policies.md.
• Build and run the vendored revision first. Use a normal or debug build before reaching for ASan, UBSan, or guard pages. Keep compiler, configure flags, platform, thread count, environment, command line, and exit/signal status.
• Run the same test on latest upstream and with the proposed fix. The matrix must distinguish vulnerable failure, fixed pass, and latest-upstream status. Repeat scheduling-sensitive tests enough to justify reliability and record the number of rounds.
• Capture complete symbolized stacks with file and line numbers, each tied to one exact revision and build. Preserve the original numbering and every frame from the first emitted frame (#0 or #1) through the final #N; never omit frames in the middle or replace them with an ellipsis. Label and include each stack separately when the report has faulting-thread, thread-creation, or multiple-manifestation stacks. The validator rejects a stack that skips, duplicates, reorders, or elides frames.
• Use a uniquely named input. If a generator exists, run it and confirm it produces that input; if none can be recovered, say so rather than claiming reproducibility that was not tested.

Standalone test gate. A CLI reproduction gets the issue triaged; a test in the project's own harness gets it fixed, and stays as a regression guard afterwards. If the evidence does not already include one, decide whether you can write one — do not quietly settle for a command line. The routing block prints the harness, where its tests live, and how a new one is registered.

Ask with AskUserQuestion first: the user may already have a test, or may not want one attached, and a build cycle is expensive. Then follow sherlock's T3 mechanism (.claude/skills/sherlock/SKILL.md, Third-Party Library Sub-Workflow) rather than inventing a scheme — three branches forked from the vendored revision, so test, instrumentation and fix stay separable:

<vendored revision>
  └── msr/<library>/test      ← the test commit, on its own
        ├── msr/<library>/debug ← instrumentation on top of the test
        └── msr/<library>/fix   ← the fix on top of the test

1. Read an existing test in that harness and copy its shape.
2. On the test branch, write the smallest test that fails on the vendored revision, and register it the way that harness requires (a FATE .mak entry and ref file, a test.mk/CMakeLists.txt line, a meson.build entry, a #[test] fn, …). Export with git format-patch -1 --stdout > 01-test-<desc>.patch.
3. On the debug branch, add temporary logging to prove the traced path is actually hit (fprintf(stderr, "..."), or the library's own debug macro — dav1d_log, aom_internal_error). Build and run there, keep the log as evidence, then switch back to test so the exported patches stay clean. Instrumentation never ships in an attached patch.
4. On the fix branch, make the change, and re-run the test both ways.
5. Record both results in the matrix, and confirm the test patch applies and runs on its own before the fix patch goes on top.

The gate is also a scope check, exactly as sherlock's T3 result table treats it. If the test does not reproduce upstream at the vendored revision, the defect is probably in Firefox's integration or its local patches, not in the library — stop and say so rather than sending an upstream report that the maintainer cannot reproduce. If it reproduces differently, the scope is split and both halves need saying.

Three libraries have no usable upstream suite — libsoundtouch (SoundStretch CLI only), nICEr and widevine-adapter. There, a self-contained main() or a Firefox gtest is the honest substitute; say which you chose.

If a test genuinely cannot be written, record the concrete blocker: no upstream suite at all, an input that cannot be redistributed, a failure that needs a sanitizer the harness does not build with, or timing dependence that makes it unreliable under the runner. "No test was written" with no reason is not an acceptable answer, and the validator rejects the report for it.

4. Trace the root cause and identify history

The tracer and archaeologist subagents draft research/code-path.md and research/history.md. The main agent re-opens the cited lines, decides what is verified, and writes the trace that ships.

• Read every function in the claimed call path at the pinned revision. For stateful or frame-threaded codecs, explain worker contexts, reference/frame state, and how decoding state is handed from one worker or frame to the next.
• Write the Code Path Trace as a numbered 1…N sequence: function name, arrowed call chain, short explanation, revision-pinned links with line anchors. Keep READ and WRITE paths separate when they share state but fail in different functions. Explain non-obvious pointer arithmetic in plain language.
• Find the introducing commit with git log -S, git log -G, git blame, and parent comparison. Call it "first affected" only when the evidence supports it; otherwise say "introducing commit unknown" and state what was checked.
• Create the fix on top of the test commit and export both with git format-patch. The test patch must apply independently; the fix patch goes on top. Squash exploratory commits so the test attachment is one complete patch. Keep debug instrumentation out of both.
• For complicated multithreaded or stateful bugs, add a companion note for a reader with no codec knowledge, and keep the numbered trace concise.

5. Write the report and the submission draft

5a — core evidence. Write REPORT_DIR/<library>-security-report.md using the skeleton in report-template.md and the content rules in report-core.md. Every core item is either populated or explicitly Unknown/Not available/Not applicable with a reason.

Name the report for the defect, not the library alone — vp9-frame-thread-flush-oob.md tells a maintainer what it is before they open it. Fill every placeholder from evidence; never invent or hardcode a name, an email address, an employer, a disclosure deadline, or an AI-usage statement — ask.

5b — channel packaging. Apply the profile: deliver the crash input the way the channel requires, add the metadata it wants, and omit the metadata it forbids (CVSS and CWE are welcome on GitHub and forbidden on Bugzilla). Write the confidentiality mechanics into the report so the user cannot miss them.

5c — submission draft. Fill the channel's template from submission-drafts.md into REPORT_DIR/submission-draft.md. It is a draft. Do not send it.

6. Audit and hand off

• Run the validator and fix every error; warnings require an explicit decision:

  python3 .claude/skills/media-security-report/scripts/validate_media_report.py \
      REPORT_DIR/<library>-security-report.md --library <id>
  

• Launch an independent audit subagent (Agent) that has not seen this run's reasoning. Give it the report path only, and have it write research/audit.md: open every source link and confirm the cited file and line still say what the report claims; confirm every link into the library's repository is pinned to the vendored revision; confirm the crash input is delivered the way the channel requires; confirm the fixed/unfixed/latest matrix matches the logs; confirm every crash stack is complete and consecutively numbered with no omitted middle frames; flag any downstream detail that leaked.

• When a proposed fix exists, get a second opinion with Skill(red-pen, …), passing the report path and the patch path. The reviewer may argue for a different fix design — that is in scope; escalate it to the user rather than quietly keeping the original patch.

• Report what was not available instead of silently omitting it.

Hand off with this shape, and nothing more:

**Security report — <library>** ([report](<path>) · [draft](<path>))
- Verdict: <security-relevant and reproducible | not security-relevant | unverified>
- Channel: <profile> → <intake>   (secondary: <… | none>)
- Revisions: vendored `<ref>` / vulnerable `<ref>` / latest `<ref>` / fixed `<ref|n/a>`
- Crash input: <attached <name> | inline base64 | encrypted attachment>
- Standalone test: <in <harness>, attached as <patch> | not feasible: <blocker>>
- Artifacts: <list>
- Validator: <PASS/FAILED, error and warning counts>
- Do these in order when you file:
  1. <one-shot / irreversible step first>
  2. 
 
 Unresolved: <… | none>

The user files the report. This skill never does.

Resources

• report-template.md: the section skeleton a finished report follows, derived from an accepted upstream report.
• report-core.md: the universal evidence core, report order, evidence rules, artifact naming, hygiene.
• channel-profiles.md: the six channels, their mechanics, traps, and what each one wants or forbids.
• library-policies.md: the routing table, per-library extras, build/test hints, known unknowns.
• submission-drafts.md: one draft template per channel.
• scripts/media_lib_facts.py: live per-library facts from the checkout.
• scripts/validate_media_report.py: pre-submission structural checker.
• scripts/channel_policy.py: the machine-readable policy tables.
• source-permalinks skill: revision-pinned URL patterns per forge.
• red-pen skill: independent review of the proposed fix.