Skip to content
skillsafebeta
← Report library
Purpose / Documents

Azure Ai Skill Security Audit

What the author says it does (original text)

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

Independent security check

Security risks found

Files checked
16
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Local documents, images, audio, or text may be sent to Azure services

Source references: 4
What we found

The reference patterns encode local documents into analysis requests, give image bytes to an image-analysis client, or send audio files into a transcription stream. This moves content outside the local environment for processing by the configured Azure endpoint.

Why this matters

Contracts, identity documents, meeting recordings, customer data, or other confidential input may become subject to the Azure resource's region, tenant permissions, service logging, and retention settings, and may incur usage charges.

These are SDK reference patterns and do not run merely because the Skill is installed. However, if used against a configured Azure endpoint, local documents, image bytes, or audio are submitted to Azure for processing, potentially exposing sensitive content. Users can require explicit upload confirmation, endpoint and retention details, and limits on readable files.

references/sdk/azure-ai-document-intelligence-ts.md:24In the instructionsOpen original file
- Must use `getLongRunningPoller(client, initialResponse)` then `poller.pollUntilDone()`- Local file: send as `base64Source` in body, not as binary stream- Pagination: `import { paginate } from "@azure-rest/ai-document-intelligence"`
Show 3 other places
references/sdk/azure-ai-vision-imageanalysis-py.md:19In the instructionsOpen original file
## Non-Obvious Patterns- `analyze_from_url(image_url=..., visual_features=[...])` for URL; `analyze(image_data=bytes)` for file- VisualFeatures enum: `CAPTION`, `DENSE_CAPTIONS`, `TAGS`, `OBJECTS`, `READ`, `PEOPLE`, `SMART_CROPS`
references/sdk/azure-ai-transcription-py.md:22In the instructionsOpen original file
- Batch: `client.begin_transcription(name=..., locale="en-US", content_urls=[...], diarization_enabled=True)`- Real-time: `stream = client.begin_stream_transcription(locale="en-US"); stream.send_audio_file("audio.wav")`
references/sdk/azure-ai-translation-ts.md:22In the instructionsOpen original file
- Document translation: separate package `@azure-rest/ai-translation-document`- Batch docs require SAS URLs for source/target blob containers
Medium risk

Content Safety analysis results may be retained in logs

Source references: 2
What we found

Both the Python and TypeScript guides recommend logging analysis results or moderation decisions, but do not limit whether logs contain original content, image information, classifications, user identifiers, or define access and retention controls.

Why this matters

Moderated input and harmful-content labels can involve private communications or sensitive classifications. If raw or identifiable information enters centralized logs, more people and systems may retain access to it.

Both guides recommend logging analysis results or moderation decisions, so an implementation may create persistent records. The source does not require logging raw input, images, or user identities and gives no retention period, so the exposure scope is unspecified. Users can ask that logs contain only necessary categories and scores, with access controls, redaction, and deletion deadlines.

references/sdk/azure-ai-contentsafety-py.md:29In the instructionsOpen original file
4. Use `halt_on_blocklist_hit` for immediate rejection5. Log analysis results for audit and improvement6. Consider 8-severity mode for finer-grained control
Show 1 other places
references/sdk/azure-ai-contentsafety-ts.md:29In the instructionsOpen original file
3. Use blocklists for domain-specific terms to supplement AI detection4. Log moderation decisions — keep audit trail for compliance5. Handle edge cases — empty text, very long text, unsupported image formats
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Local examples can automatically use the developer's existing Azure login

Source references: 5
What we found

The authentication guide says `DefaultAzureCredential` can obtain existing credentials from Azure CLI, PowerShell, VS Code, and similar tools. Search clients can also create or update indexes and upload or delete documents, so effective access depends on the current identity's RBAC scope.

Why this matters

If the agent targets the wrong tenant, subscription, search service, or index, it could read organizational search data or change indexes and documents using the user's existing privileges.

The authentication guide says local `DefaultAzureCredential` can use existing CLI, PowerShell, or VS Code credentials, while the Search references describe creating or updating indexes and uploading or deleting documents. These are examples, not automatic actions, but when combined their cloud impact depends on the current identity's RBAC permissions. Users can require confirmation of the identity, subscription, resource, and operation, and use a dedicated least-privilege identity.

references/auth-best-practices.md:77In the instructionsOpen original file
`DefaultAzureCredential` is ideal for local dev because it automatically picks up credentials from developer tools:1. **Azure CLI** — `az login`2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
Show 4 other places
references/sdk/azure-search-documents-ts.md:20In the instructionsOpen original file
- Semantic search requires `queryType: "semantic"` + `semanticSearchOptions`- Batch ops: `searchClient.indexDocuments({ actions: [{ upload: doc }, { delete: doc }] })`
references/sdk/azure-search-documents-py.md:34In the instructionsOpen original file
9. Always define semantic configuration for agentic retrieval indexes10. Use `create_or_update_index` for idempotent index creation11. Close clients with context managers or explicit `close()`
references/sdk/azure-search-documents-dotnet.md:24In the instructionsOpen original file
## Best Practices1. Use `DefaultAzureCredential` for **local development only**. In production, use `ManagedIdentityCredential` — see [auth-best-practices.md](../auth-best-practices.md)2. Use `FieldBuilder` with model attributes for type-safe index definitions3. Use `CreateOrUpdateIndexAsync` for idempotent index creation4. Batch document operations for better throughput
references/auth-best-practices.md:20In the instructionsOpen original file
1. **Unpredictable fallback chain** — walks through multiple credential types, adding latency and making failures harder to diagnose.2. **Broad surface area** — checks environment variables, CLI tokens, and other sources that should not exist in production.3. **Non-deterministic** — which credential actually authenticates depends on the environment, making behavior inconsistent across deployments.4. **Performance** — each failed credential attempt adds network round-trips before falling back to the next.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

This Skill is an operational and SDK reference for Azure AI services. It prefers Azure MCP for search-index queries and speech transcription or synthesis, and provides dependency-installation and client examples in several languages.

View source
SKILL.md:21In the instructionsOpen original file
## MCP Server (Preferred)When Azure MCP is enabled:
SKILL.md:26In the instructionsOpen original file
### AI Search- `azure__search` with command `search_index_list` - List search indexes- `azure__search` with command `search_index_get` - Get index details- `azure__search` with command `search_query` - Query search index### Speech- `azure__speech` with command `speech_transcribe` - Speech to text- `azure__speech` with command `speech_synthesize` - Text to speech

The referenced guides cover patterns that give local files, text, images, or Blob URLs to Azure clients. They also mention interfaces capable of creating or updating search indexes, uploading or deleting indexed documents, and managing Content Safety blocklists.

View source
references/sdk/azure-ai-document-intelligence-ts.md:22In the instructionsOpen original file
- REST client — `DocumentIntelligence` is a function, not a class- Analyze path: `client.path("/documentModels/{modelId}:analyze", "prebuilt-layout").post({...})`- Must use `getLongRunningPoller(client, initialResponse)` then `poller.pollUntilDone()`- Local file: send as `base64Source` in body, not as binary stream- Pagination: `import { paginate } from "@azure-rest/ai-document-intelligence"`
references/sdk/azure-search-documents-ts.md:20In the instructionsOpen original file
- Semantic search requires `queryType: "semantic"` + `semanticSearchOptions`- Batch ops: `searchClient.indexDocuments({ actions: [{ upload: doc }, { delete: doc }] })`
references/sdk/azure-search-documents-py.md:34In the instructionsOpen original file
9. Always define semantic configuration for agentic retrieval indexes10. Use `create_or_update_index` for idempotent index creation11. Close clients with context managers or explicit `close()`
references/sdk/azure-ai-contentsafety-ts.md:22In the instructionsOpen original file
- Image: `client.path("/image:analyze").post({ body: { image: { content: base64 } } })`- Blocklist create: `.path("/text/blocklists/{blocklistName}", name).patch({...})`- API key import: `AzureKeyCredential` from `@azure/core-auth` (not `@azure/identity`)

The authentication guide distinguishes local development from production: local code may use identities already present in developer tools, while production guidance recommends managed identity, least-privilege RBAC, and no hardcoded credentials.

View source
references/auth-best-practices.md:7In the instructionsOpen original file
Use **managed identities** and **Azure RBAC** in production. Reserve `DefaultAzureCredential` for **local development only**.
references/auth-best-practices.md:77In the instructionsOpen original file
`DefaultAzureCredential` is ideal for local dev because it automatically picks up credentials from developer tools:1. **Azure CLI** — `az login`2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
references/auth-best-practices.md:112In the instructionsOpen original file
- [ ] Use managed identity for all Azure-hosted apps- [ ] Never hardcode credentials, connection strings, or keys- [ ] Apply least-privilege RBAC roles at the narrowest scope- [ ] Use `ManagedIdentityCredential` (not `DefaultAzureCredential`) in production- [ ] Store any required secrets in Azure Key Vault- [ ] Rotate secrets and certificates on a schedule
Start here · InstructionsSKILL.md
azure-ai
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 17
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records16 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/sdk/azure-ai-contentsafety-java.mdFull text included
  • references/sdk/azure-ai-contentsafety-py.mdFull text included
  • references/sdk/azure-ai-contentsafety-ts.mdFull text included
  • references/sdk/azure-ai-document-intelligence-dotnet.mdFull text included
  • references/sdk/azure-ai-document-intelligence-ts.mdFull text included
  • references/sdk/azure-ai-openai-dotnet.mdFull text included
  • references/sdk/azure-ai-transcription-py.mdFull text included
  • references/sdk/azure-ai-translation-text-py.mdFull text included
  • references/sdk/azure-ai-translation-ts.mdFull text included
  • references/sdk/azure-ai-vision-imageanalysis-java.mdFull text included
  • references/sdk/azure-ai-vision-imageanalysis-py.mdFull text included
  • references/sdk/azure-search-documents-dotnet.mdFull text included
  • references/sdk/azure-search-documents-py.mdFull text included
  • references/sdk/azure-search-documents-ts.mdFull text included
  • references/auth-best-practices.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/auth-best-practices.mdSupporting file
  • references/sdk/azure-ai-contentsafety-java.mdSupporting file
  • references/sdk/azure-ai-contentsafety-py.mdSupporting file
  • references/sdk/azure-ai-contentsafety-ts.mdSupporting file
  • references/sdk/azure-ai-document-intelligence-dotnet.mdSupporting file
  • references/sdk/azure-ai-document-intelligence-ts.mdSupporting file
  • references/sdk/azure-ai-openai-dotnet.mdSupporting file
  • references/sdk/azure-ai-transcription-py.mdSupporting file
  • references/sdk/azure-ai-translation-text-py.mdSupporting file
  • references/sdk/azure-ai-translation-ts.mdSupporting file
  • references/sdk/azure-ai-vision-imageanalysis-java.mdSupporting file
  • references/sdk/azure-ai-vision-imageanalysis-py.mdSupporting file
  • references/sdk/azure-search-documents-dotnet.mdSupporting file
  • references/sdk/azure-search-documents-py.mdSupporting file
  • references/sdk/azure-search-documents-ts.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:70In the instructionsOpen original file
- AI Search indexing and queries -> [Azure AI Search documentation](https://learn.microsoft.com/azure/search/search-what-is-azure-search)- Speech transcription patterns -> [Azure AI Speech documentation](https://learn.microsoft.com/azure/ai-services/speech-service/overview)
SKILL.md:71In the instructionsOpen original file
- AI Search indexing and queries -> [Azure AI Search documentation](https://learn.microsoft.com/azure/search/search-what-is-azure-search)- Speech transcription patterns -> [Azure AI Speech documentation](https://learn.microsoft.com/azure/ai-services/speech-service/overview)
references/auth-best-practices.md:3In the instructionsOpen original file
> Source: [Microsoft — Passwordless connections for Azure services](https://learn.microsoft.com/azure/developer/intro/passwordless-overview) and [Azure Identity client libraries](https://learn.microsoft.com/dotnet/azure/sdk/authentication/).
Run commands
references/auth-best-practices.md:16In the instructionsOpen original file
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
references/auth-best-practices.md:81In the instructionsOpen original file
2. **Azure Developer CLI** — `azd auth login`3. **Azure PowerShell** — `Connect-AzAccount`4. **Visual Studio / VS Code** — sign in via Azure extension
references/auth-best-practices.md:87In the instructionsOpen original file
// Local development only — uses CLI/PowerShell/VS Code credentialsconst credential = new DefaultAzureCredential();
Read keys or account settings
references/auth-best-practices.md:16In the instructionsOpen original file
| **CI/CD pipelines** | `AzurePipelinesCredential` / `WorkloadIdentityCredential` | Scoped to pipeline identity || **Local development** | `DefaultAzureCredential` | Chains CLI, PowerShell, and VS Code credentials for convenience |
references/auth-best-practices.md:32In the instructionsOpen original file
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials
references/auth-best-practices.md:33In the instructionsOpen original file
var credential = Environment.GetEnvironmentVariable("AZURE_FUNCTIONS_ENVIRONMENT") == "Development"    ? new DefaultAzureCredential()                          // local dev — uses CLI/VS credentials    : new ManagedIdentityCredential();                      // production — deterministic, no fallback chain
Install extra software packages
references/sdk/azure-ai-contentsafety-py.md:8In the instructionsOpen original file
```bashpip install azure-ai-contentsafety```
references/sdk/azure-ai-contentsafety-ts.md:8In the instructionsOpen original file
```bashnpm install @azure-rest/ai-content-safety @azure/identity @azure/core-auth```
references/sdk/azure-ai-document-intelligence-ts.md:8In the instructionsOpen original file
```bashnpm install @azure-rest/ai-document-intelligence @azure/identity```
Lines read
655
File checksum (to compare versions)
4a2d52ac0e39dd7de8b606dacd3bffc844f31d95765c5526fbc4c4576f6ffc2a