Security audit

azure-ai-transcription-py

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a transcription guide, but it asks for broad agent tools and includes unrelated command-execution and code-analysis capabilities that do not fit the stated purpose.

Review this before installing. Use it only in an environment where you are comfortable granting read/write/exec tool access, and avoid submitting confidential recordings unless Azure data handling is approved for that content. Fix or ignore the unrelated code-analysis and generic command-execution sections, and configure only TRANSCRIPTION_ENDPOINT and TRANSCRIPTION_KEY as documented for the transcription client.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

Confidence: 92% confidence
Finding: The skill is presented as a speech transcription SDK, but it advertises unrelated capabilities such as code static analysis, dependency vulnerability detection, bulk code review, and CI/CD integration. This creates a scope-confusion problem: users and agents may grant broader trust, permissions, or invoke workflows inconsistent with the stated purpose, increasing the chance of misuse or hidden overreach.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The documentation states the required variables are TRANSCRIPTION_ENDPOINT and TRANSCRIPTION_KEY, but elsewhere introduces a generic API_KEY export pattern. Inconsistent authentication instructions can cause operators to misconfigure secrets, accidentally expose credentials, or wire the wrong secret into automation and agent environments.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The documentation claims generic command execution capability for a transcription skill and mentions executing system commands in a sandbox. For an agent skill with declared exec/write/read tools, this materially broadens the implied attack surface and may encourage unsafe invocation paths unrelated to speech transcription.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: FAQ guidance about command-line execution failure is inconsistent with a skill described as a transcription SDK. This kind of documentation drift can normalize use of exec-capable behavior and cause users or downstream agents to invoke shell operations that are unnecessary for the advertised function.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill does not clearly warn users that audio content and possibly metadata will be sent to Azure cloud services for processing. For transcription workloads, this can expose sensitive meetings, personal data, or regulated content to third-party infrastructure without adequate user awareness or consent.

Static analysis

No suspicious patterns detected.