Security audit

azure-ai-voicelive-py

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Azure VoiceLive development guide, with normal SDK setup and credential guidance and no hidden or destructive behavior found.

Install this only if you intend to build Azure VoiceLive Python applications. Review any commands before running them, keep Azure keys in environment variables or managed identity, and avoid letting generated examples write files or execute shell commands outside the project you are working on.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

Confidence: 71% confidence
Finding: The skill claims command execution and file write capabilities without prominent safety guardrails, confirmation requirements, or scope limits. In an agent context with exec/write tools enabled, vague capability claims can normalize dangerous actions and increase the likelihood of unintended system modification or misuse.

Static analysis

No suspicious patterns detected.