Security audit

Azure Transcription

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Azure transcription guide, but users should understand that audio is sent to Azure and transcripts may be saved locally.

Install only if you are authorized to send the target audio to Azure Cognitive Services and to store generated transcripts on the local machine. Use secure output directories for meetings, calls, or other recordings that may contain personal, customer, or confidential information, and keep Azure keys out of source control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill encourages uploading audio for cloud transcription without clearly warning that potentially sensitive voice content and derived transcripts are sent to Azure services. In enterprise settings, these recordings may contain PII, credentials, customer calls, or confidential meetings, so omission of a privacy/data-handling warning can cause unintended data exposure and policy violations.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill writes transcript output to local directories without clearly warning users that generated files may contain sensitive spoken content. This can lead to accidental disclosure through shared workstations, synced folders, backups, or source control if operators do not realize transcripts are persisted on disk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.