Security audit

azure-ai-voicelive-py-free

Security checks for vulnerabilities and agentic risk

Overview

This voice-integration skill is not clearly malicious, but it asks for broad read/write/command authority and includes under-scoped command and file-processing guidance beyond its stated Azure VoiceLive purpose.

Review before installing. Use it only for explicit Azure VoiceLive audio or transcription tasks, confirm users understand audio and transcripts go to Azure, and avoid granting broad exec/write/read authority unless the platform can constrain those tools to installing/running the documented SDK workflow.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The skill is described as a limited VoiceLive integration, but later sections advertise generic file processing and command execution capabilities that materially expand the apparent trust boundary. In an agent platform that grants tools based on the manifest and documentation, this mismatch can mislead users or orchestration layers into allowing broader actions than expected, increasing the risk of unsafe exec or file operations under a benign-looking voice skill.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: Security and capability sections mention command execution, whitelist commands, sandboxing, and CLI failure handling even though the skill's stated purpose is basic realtime voice interaction. This contradiction normalizes dangerous behavior and can cause operators to treat shell execution as an intended feature, enabling unnecessary high-risk tool access for a cloud-audio skill.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation guidance says to call the skill in the agent conversation with necessary parameters but does not define when it should or should not activate, what user intent is required, or what safety checks are needed first. Overly broad trigger language increases the chance of accidental activation, unintended data transmission, or use in contexts where microphone/audio handling was not explicitly requested.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill handles microphone audio and transcript data through an external Azure service, but the description does not prominently warn users that their audio, speech content, and derived transcripts are transmitted to a third-party cloud endpoint. This omission undermines informed consent and can expose sensitive personal or enterprise data during use.

Static analysis

No suspicious patterns detected.