ClawHub
Back to skill

Security audit

Azure Ai Voicelive P

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown documentation skill for Azure VoiceLive examples; it does not install code or run audio capture by itself, but users should treat the examples as cloud-connected and privacy-sensitive if executed.

Install this as Azure VoiceLive reference material. Before running any generated examples, confirm the Azure account and endpoint, avoid hard-coding API keys, and get clear user consent before microphone capture, audio upload, transcription, or function-call integrations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
The skill labels itself as documentation-only, yet it contains examples that establish live Azure connections and use real credentials. This mismatch can mislead users or agents into executing networked actions under a lower-risk assumption, weakening informed consent and security review.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
Describing the skill as documentation-only while also covering microphone capture, audio streaming, function calling, and session updates understates its operational capabilities. In an agent setting, that can cause privacy-sensitive or externally connected behavior to be invoked without appropriate guardrails or user awareness.

Vague Triggers

Medium
Confidence
78% confidence
Finding
Broad trigger keywords such as voice, azure, voicelive, and documentation are not sufficiently constrained to specific safe intents or contexts. This increases the chance of accidental activation in unrelated prompts, potentially causing an agent to surface or follow instructions involving network access, credentials, or audio handling when not clearly requested.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill discusses microphone capture, transcription, and credential handling without a clear privacy and consent warning near the activation summary. Because these capabilities involve sensitive audio data and authenticated cloud access, missing disclosure increases the risk of users or agents invoking them without understanding the privacy implications.

Static analysis

No suspicious patterns detected.