azure-ai-transcription-py
Warn
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing a package named
azure-ai-transcription. This is not the official Microsoft Azure library for speech services (which is typicallyazure-cognitiveservices-speech), representing an unverifiable dependency from an unknown source. - [REMOTE_CODE_EXECUTION]: The provided code snippets import and execute methods from the
azure-ai-transcriptionlibrary. Running code from an unverifiable package can lead to the execution of malicious scripts. - [PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection.
- Ingestion points: The skill ingests untrusted audio data from external URLs provided in the
content_urlsparameter or local audio files. - Boundary markers: There are no instructions or delimiters implemented to prevent the agent from following commands that might be embedded in the transcribed text.
- Capability inventory: The skill outputs transcribed text directly into the agent's context, which could influence downstream tasks.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the transcription output before it is processed.
- [SAFE]: The skill references the official Azure SDK GitHub repository for testing criteria and uses standard environment variable patterns for credential management.
Audit Metadata