azure-ai-voicelive-py

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.3

Overview

The skill is not clearly malicious, but it requests broad read/write/exec authority and includes generic file and command automation claims that do not fit its Azure voice purpose.

Install only if you intend to let the agent help develop and run Azure VoiceLive code with local read/write/exec access. Avoid using callback_url unless you trust the endpoint and know what data will be sent, pin dependencies before installation, and do not paste Azure key-listing output into shared logs or chats.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:107

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 107
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code:

bash

pip install azure-ai-voicelive aiohttp azure-identity

Technical Analysis

The Skill instructs users or agents to install three packages from the Python package registry without version constraints, integrity hashes, a lockfile, or an explicitly trusted package index. Consequently, the artifacts installed can change after the Skill has been reviewed.

The dependencies are relevant to the declared Azure VoiceLive functionality, but unrestricted dependency resolution is not necessary. If a package account, release pipeline, dependency, or configured package index is compromised, a malicious distribution could execute code during installation or when imported by the examples.

Attack Path

1. An attacker compromises an upstream package, one of its transitive dependencies, or the package source configured in the victim's environment.
2. The attacker publishes a malicious release that still satisfies the unrestricted installation command.
3. A user or agent follows the Skill's installation instructions.
4. pip resolves and installs the attacker-controlled artifact.
5. Malicious installation hooks or imported package code execute with the privileges of the user or agent running the command.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the account that installs or imports the package. Depending on that account's permissions, the attacker could access project files, environment variables, Azure credentials, microphone data, and network resources available to the Skill. The issue does not itself grant elevated operating-system privileges, but its scope matches all privileges already held by the invoking process.

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version and constrain transitive dependencies through a lockfile.
• Use integrity hashes, such as pip install --require-hashes -r requirements.txt.
• Generate and review a reproducible dependency manifest using an appropriate locking tool.
• Configure installation to use an explicitly trusted package index and disable unintended extra indexes.
• Install dependencies inside an isolated virtual environment or container with minimal filesystem and credential access.
• Add automated dependency vulnerability and provenance checks to the release process.
• Periodically update pins through a controlled review and testing workflow rather than resolving unrestricted latest releases at installation time.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:270

Finding

Troubleshooting Command May Disclose Active Azure Account Keys

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 270
Vulnerability Type: Sensitive credential exposure through command output
Risk Level: Low

Vulnerable Code:

bash

az cognitiveservices account keys list

Technical Analysis

The troubleshooting guidance recommends a command that returns active Azure Cognitive Services account keys. Those key values may become visible in terminal output, agent transcripts, CI logs, screen recordings, shell-session capture systems, or copied diagnostic reports.

Listing raw secret values is unnecessary when the intended objective is only to diagnose an authentication failure. Although the document otherwise recommends environment variables and avoids hardcoded credentials, this command introduces an avoidable credential-disclosure path.

Attack Path

1. A user encounters an Azure authentication failure and follows the troubleshooting guidance.
2. The Azure CLI prints active Cognitive Services account keys.
3. The output is retained in an agent conversation, CI log, terminal recording, support ticket, or shared diagnostic transcript.
4. A party with access to that retained output extracts the key.
5. The party uses the exposed key to authenticate to the associated Azure Cognitive Services resource until the credential is revoked or rotated.

Impact Assessment

Exposure may permit unauthorized use of the affected Cognitive Services resource within the permissions and service scope associated with the account key. Potential consequences include service consumption, financial charges, quota exhaustion, and access to operations authorized by the key. This does not directly provide Azure subscription administration or operating-system privileges.

Remediation

View remediation

Remediation Suggestions

• Replace raw key-listing instructions with a non-secret-bearing authentication or connectivity test.
• Prefer managed identity and DefaultAzureCredential for production use.
• If key retrieval is unavoidable, instruct users not to paste or log the output and to perform it only in a protected local terminal.
• Redact key values before retaining command output in logs, agent conversations, support tickets, or diagnostic reports.
• Restrict access to troubleshooting logs and configure short retention periods.
• Rotate both account keys immediately if either value may have been exposed.
• Use separate, least-privileged resources or credentials for development and production workloads.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented callback_url parameter allows sending results or status to an external endpoint, but there is no warning that user data, transcripts, or metadata may be exfiltrated to third-party infrastructure. In a realtime speech context, this is especially sensitive because payloads may contain PII, voice-derived text, or conversation content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as an Azure VoiceLive realtime speech integration, but later claims generic file processing, API integration, and command execution capabilities unrelated to that scope. This mismatch can mislead users or agent frameworks into granting broader trust or permissions than necessary, increasing the risk of unsafe execution paths and abuse of read/write/exec tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises file writing and command execution in a high-level capability summary without warning users about possible system-side effects. In an agent environment with write/exec tools enabled, this can cause users to invoke the skill under the false assumption that it is a speech-only integration, leading to unexpected file changes or command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The efficiency tables advertise batch file handling, multi-interface aggregation, and command execution benefits that do not match the stated speech SDK purpose. Security-wise, this kind of capability inflation can socially engineer operators into approving actions outside the intended domain, creating an opportunity for overbroad automation and unintended data access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's main body consistently documents Azure VoiceLive WebSocket, audio, and transcription workflows, but this FAQ answer tells users to debug generic 'exec' capability failures. That is not merely incomplete; it redirects intent toward command execution behavior that the rest of the substantive documentation does not implement or explain.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.