azure-ai-transcription-py

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.3

Overview

This Azure transcription skill is mostly coherent, but it requests broad command and file permissions and advertises unrelated code/security features without clear limits.

Review this skill before installing. Use it only for Azure transcription tasks, run it in an isolated environment, pin and verify the Python package, and provide Azure keys, SAS URLs, recordings, and transcript outputs only when you intentionally want them processed by Azure or another configured endpoint. Do not rely on the unrelated code-analysis or CI/CD claims unless they are split into a separately scoped skill with clear safeguards.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–56
Vulnerability Type: Unpinned dependency installation from a mutable package index
Risk Level: Medium

Vulnerable Code

bash

pip install azure-ai-transcription

The same unpinned installation instruction is referenced again at lines 168–171:

markdown

- Python 3.8 and above
- `azure-ai-transcription` package (installed through `pip install azure-ai-transcription`)

Technical Analysis

The Skill instructs the Agent to install azure-ai-transcription without specifying an exact version, verifying an integrity hash, or identifying a trusted package source. Consequently, package resolution depends on the mutable state of the default Python package index at installation time.

Python package installation can execute package-controlled build or installation logic. A future compromised or unexpectedly changed release could therefore run code under the account invoking the Agent. The absence of a lock file and integrity hashes also prevents reliable verification that the installed artifact is the same dependency that was reviewed.

This finding establishes a supply-chain exposure. The audit did not establish that the named package or its current releases are malicious.

Attack Path

1. An attacker compromises the package's publishing account or distribution channel, or causes an unsafe release to become the version selected by pip.
2. The Agent follows the Skill instruction and runs pip install azure-ai-transcription.
3. Pip resolves and downloads the attacker-controlled release because no exact version or hash is required.
4. Package-controlled installation or runtime code executes with the privileges of the Agent process.
5. That code can access resources available to the process, potentially including local audio, generated transcripts, environment variables, and Azure transcription credentials.

Impact Assessment

...[truncated 595 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version, for example:

   text

   azure-ai-transcription==<reviewed-version>
   

2. Generate a lock file containing cryptographic hashes and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Record the authoritative package publisher and trusted index URL. Configure pip to use only approved repositories and disable unintended extra indexes to reduce dependency-confusion risk.

4. Review the pinned wheel, source distribution, transitive dependencies, and package metadata before approval.

5. Install the package in an isolated virtual environment or container under a least-privileged account.

6. Avoid exposing Azure credentials during installation. Provide credentials only to the transcription process after dependency installation and verification have completed.

7. Use automated dependency monitoring, but require review and updated hashes before accepting new releases.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes sending audio content and optional callback data to external services but does not provide a prominent user-facing privacy warning about data transmission, retention, or third-party processing. For transcription workloads, inputs often contain sensitive speech, personal data, or confidential meetings, so missing disclosure materially raises privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as an Azure transcription SDK, but it also advertises unrelated code analysis, vulnerability scanning, and CI/CD review features. This scope expansion can cause an agent to invoke the skill in contexts far beyond transcription, increasing the chance that powerful tools are used on sensitive code or pipelines without clear user intent or proper safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation guidance is overly broad and tells the agent to use the skill based on general task descriptions rather than clear triggers and exclusions. In combination with powerful tools like exec/read/write, ambiguous routing increases the chance of accidental invocation on inappropriate tasks, leading to unintended data access or command execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares command-execution capability even though its stated purpose is Azure transcription. Granting exec to a broadly described skill materially increases risk because an agent may run shell commands in response to loosely related prompts, enabling destructive actions, environment access, or secret exposure unrelated to transcription.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

Most of the document consistently states the client only supports subscription-key authentication and documents locale-based language selection. Later FAQ/error text recommends considering automatic language identification for multilingual audio, which conflicts with the documented scope and examples because no such capability is shown or explained elsewhere for this client.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises generic read/write file handling beyond what is necessary for a client-library wrapper. In an agent setting, overbroad file access can lead to unintended reading of sensitive local files or overwriting user data when the skill is invoked under vague instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.