Security audit

azure-voicelive

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly describes Azure voice-bot setup, but it also asks for broad agent powers and gives under-scoped guidance for caller/audio data, so users should review it carefully before use.

Install only if you are comfortable giving the agent read, write, and command-execution authority for this workflow. Before using it with real calls, add your own privacy controls for caller consent, phone-number masking, transcript/log retention, and Azure credential handling; treat the broad file and command capabilities as out of scope unless you explicitly approve each action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documented input/output contract describes a grading or audit workflow rather than a VoiceLive speech interaction skill, creating a significant specification mismatch. In an agent context, this can cause the model or orchestrator to process unrelated user data, invoke the wrong behaviors, or mislead operators about what the skill actually does.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The capability and performance sections claim broad file processing, command execution, and data aggregation behaviors that exceed the stated voice-interaction purpose. This overclaim expands the apparent authority of the skill and may induce an agent to perform risky actions users did not intend, especially since the skill advertises read/exec/write tools.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document states outputs should avoid sensitive data, yet an example injects caller phone information into the conversation as natural-language content. This normalizes unsafe handling of personal data and can lead to disclosure in prompts, logs, transcripts, or downstream model responses.

Missing User Warnings

High

Confidence: 88% confidence
Finding: The skill includes telephony audio, caller information, and external service interaction examples without clear privacy, consent, or data-transfer warnings. In a real deployment this can result in collection and transmission of sensitive voice and caller metadata to third-party systems without adequate notice or controls.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation advertises file writing, command execution, and external API integration without corresponding user risk disclosures or execution boundaries. In an agent environment, this can encourage unsafe delegation of powerful capabilities and increase the chance of data loss, secret exposure, or command misuse.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Injecting caller-number details into a system message exposes sensitive telephony metadata in the highest-trust prompt channel. That information may then be retained in logs, surfaced to downstream tools, or echoed back by the model, turning private caller data into broadly accessible prompt content.

Static analysis

No suspicious patterns detected.