Azure语音交互免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a VoiceLive integration guide, but it under-scopes sensitive microphone/cloud use and can trigger too broadly.

Install only if you intend to build Azure VoiceLive speech workflows. Use a virtual environment, pin dependency versions, keep the Azure key out of shared files, and avoid running microphone examples until the user has explicitly agreed that audio may be sent to Azure.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:203

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 203
Vulnerability Type: Unpinned and unverifiable third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install azure-ai-voicelive aiohttp azure-identity

The same unpinned installation instructions are repeated in the dependency table at lines 317–319.

Technical Analysis

The Skill directs the Agent or user to install three packages without fixed versions, cryptographic hashes, a lock file, or an explicitly trusted package index. Consequently, pip resolves mutable package releases and transitive dependencies from the currently configured index.

Python package installation and import can execute package-controlled code with the privileges of the invoking process. If a direct or transitive dependency, package-index configuration, or future package release is compromised, following this instruction could result in arbitrary local code execution. No evidence establishes that the currently named packages are malicious; the vulnerability is the absence of dependency integrity and reproducibility controls.

This risk is especially relevant because the resulting process is expected to access an Azure API key, microphone audio, and an external voice service.

Attack Path

1. An Agent or user follows the Skill's documented pip install instruction.
2. pip resolves the latest compatible direct packages and their transitive dependencies from the configured package index.
3. An attacker compromises a dependency release, a transitive package, or the configured index and supplies malicious installation or import-time code.
4. pip installs the attacker-controlled component without hash verification detecting the substitution.
5. Malicious code executes with the privileges of the user or Agent running pip.
6. The code may access environment variables, including the Azure credential, inspect accessible ...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version rather than allowing mutable latest-version resolution.

2. Generate a lock file that records all transitive dependencies and exact resolved versions.

3. Require cryptographic hashes during installation, for example:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Configure an explicitly trusted package source, preferably an organization-controlled mirror containing reviewed artifacts.

5. Review and continuously scan direct and transitive dependencies for known vulnerabilities and unexpected ownership or release changes.

6. Install and run the integration in an isolated virtual environment or container under a non-administrative account.

7. Expose the Azure API key only to the runtime that requires it, and do not make the credential available during package installation.

8. Remove the unnecessary write capability from the declared tool list unless a documented workflow requires filesystem modification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

环境变量配置

bash

# .env 文件
AZURE_COGNITIVE_SERVICES_ENDPOINT=https://myresource.api.cognitive.microsoft.com
AZURE_COGNITIVE_SERVICES_KEY=your_api_key_here

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest says the skill is for Azure VoiceLive real-time speech AI with text/audio output and basic session management, yet it also claims it should be used for video processing, audio editing, media conversion, and dubbing generation. The rest of the file demonstrates only Azure VoiceLive conversation/session/audio-stream interactions, not video processing or general media editing/conversion capabilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states '支持中文交互' and the examples repeatedly hard-code Chinese-only behavior such as '你是一个友好的中文语音助手' and '用中文回答'. Because the skill is not documented as a China-specific or Chinese-only compliance tool, this appears to impose a language preference without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Lines L043-L061 describe create/query/modify/delete, export/save/convert, import/reset, and generic runtime operations driven by abstract parameters. However, the examples and resource descriptions only show session updates, conversation item creation/deletion, and audio/text streaming via Azure VoiceLive, not a general-purpose CRUD or conversion tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples capture microphone audio and send it to Azure over the network without an explicit user-facing privacy warning or consent step. In a voice-processing skill, this is dangerous because users may not realize live speech, background conversations, or sensitive data will be transmitted to a third-party cloud service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are so broad that the skill may activate for generic development or deployment tasks unrelated to Azure VoiceLive. In an agent ecosystem with exec enabled, overbroad routing increases the chance that this skill is invoked in inappropriate contexts, potentially causing unnecessary command execution, dependency installation, or cloud data transmission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The documentation states that the free version does not support function tools, implying no tool-calling capability. Elsewhere, the manifest explicitly allows exec/read/write and the skill is described as requiring agent execution capability, which contradicts the blanket 'not supported' claim.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example session instructions explicitly set the assistant as a Chinese voice assistant, which constrains language behavior regardless of user preference. This is a natural-language policy concern because no alternative language choice or opt-in is offered nearby.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction '用中文回答，语速适中' explicitly forces Chinese responses in the sample implementation. Without a documented reason or user choice, this is a language-policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.