Security audit

Azure语音交互免费版

Security checks for vulnerabilities and agentic risk

Overview

This voice-AI skill is not clearly malicious, but it asks for broad execution authority and describes broader actions than its Azure VoiceLive examples justify.

Install only if you intend to use Azure VoiceLive and are comfortable letting your agent install packages, run Python code, use an Azure key, and transmit text or microphone audio to Azure. Keep API keys in environment variables, avoid sensitive speech data unless you have consent, and restrict the skill to VoiceLive tasks rather than general coding or deployment work.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The skill manifest presents a narrow Azure VoiceLive capability, but the body expands it into generic media processing, CRUD-style operations, and export/save semantics that are not actually implemented or evidenced by the examples. This kind of scope inflation can mislead an agent into invoking the skill for unrelated tasks and increases the chance of unsafe exec usage or unintended data handling under false assumptions about what the tool safely supports.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation advertises create/query/modify/delete and export/save/convert/reset/import operations, but the provided code only shows session updates, conversation item creation, and audio streaming. This mismatch is dangerous because agents may infer broad file or state mutation capabilities and attempt risky exec-driven workflows that the underlying skill neither constrains nor properly specifies.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The FAQ says the free version does not support function calling, yet the dependency/platform sections frame the skill as an exec-enabled agent tool with broad command-driven automation semantics. This inconsistency can cause unsafe assumptions by the agent or user about what the skill is allowed to execute, blurring the boundary between a simple SDK example and a general automation tool.

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger condition says to use the skill for broad code generation, programming assistance, debugging, testing, and deployment activities, far beyond its narrow Azure VoiceLive purpose. Over-broad invocation criteria are dangerous because they increase the likelihood that an agent selects this exec-capable skill in inappropriate contexts, potentially causing unintended network access, credential use, or command execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The examples involve microphone capture, audio upload to Azure, and API key-based authentication, but they do not provide a prominent upfront privacy notice or explain data handling implications before use. In a voice-processing skill, this omission is meaningful because users may unknowingly transmit sensitive spoken content to a cloud service, creating privacy, consent, and compliance risks.

Static analysis

No suspicious patterns detected.