The Agent Skills Directory

[External Data Egress]: The skill transmits speaker-notes content from content.yaml to a user-configured Azure Speech region for synthesis. This is a standard part of the skill's functionality, and the documentation advises users to select approved regions and avoid regulated content.
[Credential Management]: The skill resolves credentials per invocation using either SPEECH_KEY or DefaultAzureCredential. While DefaultAzureCredential can bind to various identities in the environment (Managed Identity, Azure CLI, etc.), this behavior is consistent with Azure SDK best practices for avoiding hardcoded secrets.
[Input Parsing and Sanitization]: The skill uses yaml.safe_load for parsing YAML files and implements XML escaping (xml.sax.saxutils.escape and quoteattr) when building SSML documents. This helps mitigate potential injection risks from untrusted speaker notes or acronym aliases.
[OOXML Parsing Security]: When embedding audio into PowerPoint decks, the skill utilizes python-pptx, which has external entity resolution disabled by default. Additionally, the skill's own XML timing template is parsed using a hardened XMLParser(resolve_entities=False, no_network=True) to prevent XXE attacks.
[Indirect Prompt Injection Surface]: The skill processes content.yaml files which may be generated by upstream agents. While this represents an ingestion surface for untrusted data, the skill acts as a passive processor (generating audio) and does not execute instructions found within the data. Mitigations include the aforementioned XML escaping and boundary markers in the SSML template.

tts-voiceover