Podcast Generation with Microsoft Foundry

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:20 AM UTC
• Version: 0.1.0

Overview

This skill is a coherent Azure OpenAI podcast-generation guide, with normal cloud-processing and storage considerations users should understand before copying the examples.

Reasonable to use for Azure OpenAI podcast generation, but protect the Azure API key, validate or allowlist the endpoint before connecting, confirm provider and application retention rules, and avoid sending confidential, regulated, or customer content unless approved. If using the helper CLI, change the output-path handling or pass only expected .pcm inputs to avoid accidental overwrite.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/code-examples.md:42

Finding

Unvalidated WebSocket Endpoint May Expose the Azure OpenAI API Key

Content

View full analysis

Vulnerability Details

File Location: references/code-examples.md:42-44
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

python

ws_url = settings.azure_openai_audio_endpoint.replace("https://", "wss://") + "/openai/v1"
client = AsyncOpenAI(websocket_base_url=ws_url, api_key=settings.azure_openai_audio_api_key)

Technical Analysis

The example obtains the service endpoint from configuration and passes the resulting WebSocket URL to an authenticated client without validating its scheme, hostname, port, or ownership. String replacement is not a security boundary and does not ensure that the destination is a legitimate Azure OpenAI resource.

If an attacker can modify AZURE_OPENAI_AUDIO_ENDPOINT or its corresponding application setting, the application may connect to an attacker-controlled WebSocket server while supplying Azure authentication information. Configuration control is required for exploitation, but deployments commonly expose environment configuration through CI/CD variables, container settings, deployment manifests, or administrative interfaces.

The same unsafe pattern is also documented in SKILL.md:34-41 and references/acceptance-criteria.md:33-42.

Attack Path

1. An attacker gains the ability to influence the configured Azure OpenAI audio endpoint, such as through a compromised deployment variable, manifest, or configuration interface.
2. The attacker changes the endpoint to an attacker-controlled TLS-enabled host.
3. A user or scheduled application workflow starts podcast generation.
4. The code converts the configured URL into a WebSocket URL and initializes AsyncOpenAI with the genuine API key.
5. The client connects to the malicious endpoint and may transmit authentication material to that endpoint.
6. The attacker captures the credential and attempts to use it against the associated Azure resource until it is revoked or expires.

Impact As

...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

• Parse the endpoint with a standard URL parser rather than using string replacement.
• Require the original scheme to be https and the generated scheme to be wss.
• Reject URLs containing user information, fragments, unexpected query parameters, or non-approved ports.
• Allowlist the exact Azure resource hostname or a tightly controlled set of expected Azure domains, with appropriate checks that prevent deceptive suffixes.
• Keep endpoint configuration in a protected deployment secret or trusted configuration store with restricted write access and audit logging.
• Use a narrowly scoped, rotatable credential or managed identity where supported.
• Avoid logging API keys or authenticated WebSocket headers.
• Fail closed if endpoint validation fails, and add tests covering malicious hosts, malformed URLs, alternate schemes, and hostname-suffix bypasses.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/pcm_to_wav.py:64

Finding

PCM Conversion CLI Can Overwrite Its Input File

Content

View full analysis

Vulnerability Details

File Location: scripts/pcm_to_wav.py:64-69
Vulnerability Type: Unsafe output-path construction and destructive file overwrite
Risk Level: Low

python

if len(sys.argv) > 1:
    with open(sys.argv[1], 'rb') as f:
        pcm_data = f.read()
    wav_data = pcm_to_wav(pcm_data)
    output_path = sys.argv[1].replace('.pcm', '.wav')
    with open(output_path, 'wb') as f:
        f.write(wav_data)

Technical Analysis

The output path is produced with an unrestricted string replacement. When the supplied input path does not contain the exact lowercase substring .pcm, replace() returns the original path unchanged. Opening that path with mode wb truncates the original file before writing the generated WAV data.

Replacement can also affect an unintended portion of a directory or filename instead of changing only the final suffix. The script does not verify that input and output resolve to distinct files and does not request confirmation before overwriting an existing output.

Attack Path

1. A user invokes the conversion script with a readable and writable filename that does not contain .pcm, for example python scripts/pcm_to_wav.py recording.raw.
2. The script reads the original bytes into memory.
3. recording.raw.replace(.pcm, .wav) remains recording.raw.
4. The script reopens that same path using wb, immediately truncating the original file.
5. WAV-formatted output replaces the original content, causing irreversible data loss unless a backup exists.

In a workflow where another party controls the input path supplied to the script, that party could induce modification of a file accessible to the invoking account. However, the attacker cannot use this issue alone to bypass operating-system file permissions.

Impact Assessment

Exploitation can destroy or corrupt any file that the invoking process is authorized to read and write and that is supplie ...[truncated 199 chars]

Remediation

View remediation

Remediation Suggestions

• Construct the output path using pathlib.Path.with_suffix(".wav") so only the final extension is changed.
• Resolve or normalize both paths and explicitly reject cases where input and output identify the same file.
• Consider requiring a separate output argument instead of deriving it implicitly.
• Refuse to overwrite an existing output file by default, or require an explicit --force option.
• Open a newly created output with exclusive mode (xb) when overwrite behavior is not requested.
• Validate that the input has an expected .pcm suffix if that is a functional requirement.
• Add tests for inputs ending in .pcm, uppercase suffixes, files without suffixes, existing output files, and paths containing .pcm only in a directory component.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to send arbitrary text to Azure OpenAI over a WebSocket/API connection but does not clearly warn that submitted content leaves the local environment and is transmitted to a third-party cloud service. This creates a real privacy and data-handling risk because users may unknowingly submit sensitive, regulated, or proprietary text for audio generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guidance describes sending podcast scripts and receiving transcripts/audio via Azure OpenAI Realtime over WebSocket, but it does not warn users that submitted content leaves the local environment and is transmitted to a third-party cloud service. This can lead developers to unknowingly route sensitive or regulated text to Azure, creating privacy, compliance, and data-handling risks, especially for internal documents, customer data, or confidential transcripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents code that sends bookmark/query-derived content to an external Realtime API and then stores the returned transcript and audio in the database. The surrounding documentation does not include any warning about third-party transmission, persistence of generated content, or privacy impact, which is required for markdown when behavior could affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/code-examples.md:43