azure-ai-contentunderstanding-py

SAFE max severity MEDIUMSkillSpector Caution 0 registry microsoft last scanned 2026-02-05 1 scan

Verdict safe, but 2 findings (2 medium), mainly data exfiltration, prompt injection. Most recent scan 2026-02-05.

This Azure AI Content Understanding skill presents MEDIUM security risks primarily related to unvalidated external URL processing and missing security guidance. The skill is a documentation/SDK wrapper without executable scripts, which reduces attack surface. However, it demonstrates processing arbitrary URLs without validation (indirect prompt injection risk via transitive trust), lacks environment variable validation, and provides no security guidance on credential management or URL validation. The missing optional metadata fields reduce transparency. No critical threats like data exfiltration, command injection, or hardcoded secrets were found, but the skill needs security hardening around external content processing and credential handling.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High0

Medium2

Low0

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 0

Score0 / 100

Issues0

Version2.12.0 (static)

SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Azure AI Content Understanding SDK for Python. Use for multimodal content extraction from documents, images, audio, and video. Triggers: "azure-ai-contentunderstanding", "ContentUnderstandingClient", "multimodal analysis", "document extraction", "video analysis", "audio transcription".

Package: 2 files, 14 KB
SKILL.md: 696 words, 12+ sections
Code: None. Instructions only.

SKILL.md covers: Azure AI Content Understanding SDK for Python · Installation · Environment Variables · Authentication · Core Workflow · Prebuilt Analyzers · Analyze Document · Analyze document from URL · Access markdown content (contents is a list) · Access Document Content Details · Analyze Image · Analyze Video

Findings

MEDIUM Missing Environment Variable Validation and Hardcoded Secrets Risk Data Exfiltrationllm

The skill requires CONTENTUNDERSTANDING_ENDPOINT environment variable but provides no validation or error handling. Instructions show direct os.environ access without checking if the variable exists, which could lead to runtime errors. Additionally, there's no guidance on secure credential management, increasing risk of hardcoded secrets or insecure credential storage.

SKILL.md

```python
endpoint = os.environ["CONTENTUNDERSTANDING_ENDPOINT"]
credential = DefaultAzureCredential()
client = ContentUnderstandingClient(endpoint=endpoint, credential=credential)
```

Remediation: Add environment variable validation with clear error messages. Include security guidance on credential management: use Azure Key Vault or managed identities, never hardcode credentials, validate endpoint URLs to prevent SSRF attacks.

MEDIUM Unvalidated External URL Processing Creates Indirect Injection Risk Prompt Injectionllm

The skill demonstrates analyzing content from arbitrary URLs without any validation, sanitization, or security warnings. Code examples show direct URL processing (AnalyzeInput(url="https://example.com/document.pdf")) with no guidance on validating URL sources, checking domains, or handling malicious content. This creates transitive trust abuse where the agent could be instructed to process attacker-controlled URLs containing malicious instructions or content.

SKILL.md

```python
poller = client.begin_analyze(
    analyzer_id="prebuilt-documentSearch",
    inputs=[AnalyzeInput(url="https://example.com/document.pdf")]
)
```

Remediation: Add URL validation requirements: whitelist trusted domains, implement URL sanitization, warn users about processing untrusted URLs, add content-type validation, implement size limits, and provide guidance on handling potentially malicious content from external sources.

What is in the package

File	Kind	Size
`SKILL.md`	doc	7.7 KB
`references/acceptance-criteria.md`	doc	5.9 KB

External hosts referenced

github.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22 at commit cfbcbbdc679c. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/microsoft/agent-skills
Raw scan result: github-skills-azure-ai-contentunderstanding-py-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/microsoft-azure-ai-contentunderstanding-py.svg)
Request a re-scan