azure-ai-transcription-py
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
azure-ai-transcriptionpackage via pip. This is not the standard official SDK for Microsoft Azure Speech services (e.g.,azure-ai-speechorazure-cognitiveservices-speech). Installing unknown or non-standard packages from public registries carries a supply chain risk. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to transcribe audio from external URLs and real-time streams, creating a data ingestion surface where malicious instructions hidden in audio files could be processed by the agent after transcription.
- Ingestion points:
content_urlsinbegin_transcriptionand audio stream input viasend_audio_file. - Boundary markers: None provided to distinguish transcribed text from agent instructions.
- Capability inventory: Package installation (
pip), file system access (send_audio_file), and credential access (os.environ). - Sanitization: No evidence of sanitization or filtering of the transcribed output.
Audit Metadata