Tts Voiceover

title: TTS Voice-Over Skill Security Model description: STRIDE threat model for the tts-voiceover skill organized by assets, adversaries, and trust buckets (CLI to Azure Speech, environment/Entra credentials, untrusted content inputs, CLI caller process) with in-code mitigations and acknowledged enterprise readiness gaps author: microsoft/hve-core ms.date: 2026-10-28 ms.topic: reference estimated_reading_time: 10 keywords:

• security

• STRIDE

• tts-voiceover

• azure speech

• threat model

<!-- markdownlint-disable-file -->

TTS Voice-Over Skill Security Model

This document records the STRIDE threat model for the tts-voiceover skill (scripts/generate_voiceover.py and its wrappers). The model is organized by trust bucket: CLI → Azure Speech API (B1), Environment and Entra credentials (B2), Untrusted content inputs (B3), and CLI caller process and filesystem (B4). Each bucket enumerates all six STRIDE categories. Presentation-file parsing and audio embedding are retired; WAV synthesis remains.

The skill reads content.yaml speaker notes, escapes them into SSML, and synthesizes one WAV per slide through the Azure Cognitive Services Speech SDK over TLS. It runs no local listener and persists no credentials to disk; credentials are read from the process environment (or resolved through DefaultAzureCredential) per invocation.

See also: repo-wide STRIDE model. This skill participates in the repository-wide threat model at docs/security/security-model.md and is registered in its Skill Security Models section.

Executive Summary

The skill synthesizes narration by sending speaker notes to Azure Speech over TLS. Its highest-risk behavior remains content egress to the configured region without a data-classification gate. Credentials are read per invocation, never persisted; YAML uses safe_load and dynamic SSML values are escaped. Synthesis requires an explicit SPEECH_REGION. Retirement removes presentation/XML archive parsing and its lxml/Pillow dependencies, not speech authentication or disclosure risk.

Security Posture Overview

Contents

• System Description

• Trust Boundaries

• Assets

• Adversaries

• Bucket B1: CLI → Azure Speech API

• Bucket B2: Environment and Entra credentials

• Bucket B3: Untrusted content inputs

• Bucket B4: CLI caller process and filesystem

• Enterprise Readiness Gaps

• References

System Description

Components

1. scripts/generate_voiceover.py — reads content.yaml, escapes speaker notes into SSML, and synthesizes one WAV per slide via the Azure Speech SDK.

2. Bash/PowerShell wrappers manage the existing skill environment and invoke synthesis.

3. Credential resolution — SPEECH_KEY from the environment, or an Entra token minted by DefaultAzureCredential.

Data Flow

flowchart TD
    subgraph HOST["Operator Workstation / Runner (trust zone)"]
        GEN["generate_voiceover.py"]
        CRED["SPEECH_KEY env /<br/>DefaultAzureCredential"]
        OUTW["Per-slide WAV files"]
    end
    subgraph INPUT["Inputs (operator-supplied, may be upstream-generated)"]
        YAML["content.yaml / lexicon"]
    end
    subgraph AZURE["Azure Speech (network boundary)"]
        SPEECH["Speech endpoint (region)"]
    end
    YAML -->|"parsed (safe_load), escaped to SSML"| GEN
    GEN -->|"reads"| CRED
    GEN -->|"SSML synthesis request (TLS)"| SPEECH
    SPEECH -->|"WAV audio"| GEN
    GEN -->|"writes"| OUTW

Trust Boundaries

Boundary Diagram

┌───────────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY: Operator Workstation / Runner                 │
│  ┌────────────────────┐  ┌──────────────┐  ┌───────────────┐  │
│  │ generate_voiceover │  │ Credentials  │  │ WAV outputs   │  │
│  │ + wrappers        │  │ (env/Entra)  │  │               │  │
│  └────────────────────┘  └──────────────┘  └───────────────┘  │
└───────────────┬─────────────────────────┬─────────────────────┘
                │ TLS                      │ parse (no egress)
   ┌─────────────▼──────────────┐  ┌────────▼─────────────────────┐
   │ BOUNDARY: Azure Speech     │  │ BOUNDARY: Inputs (untrusted) │
    │  Speech endpoint (region)  │  │  content.yaml / lexicon      │
   └────────────────────────────┘  └──────────────────────────────┘

Boundary Descriptions

Assets

Adversaries

Bucket B1: CLI → Azure Speech API

Spoofing

• Transport security is delegated to the Azure Speech SDK, which validates the endpoint certificate against the system trust store. The skill constructs no raw HTTP requests and performs no redirect handling of its own.

Tampering

• TLS protects the SSML request and the synthesized audio response in transit; the skill performs no plaintext fallback.

Repudiation

• The CLI returns deterministic exit codes (EXIT_SUCCESS / EXIT_FAILURE / EXIT_ERROR) and logs per-slide synthesis outcomes so automation can attribute failures.

Information Disclosure

• SPEECH_KEY and the Entra token are passed only to the SDK and are never written to logs. Synthesis failures log only cancellation.reason and error_details, not the credential.

• Speaker-notes content (A3) leaves the trust boundary to the Azure region for synthesis. There is no data-classification gate (G-INF-1).

Denial of Service

• Token-refresh failures are caught and logged; the previous token is retained rather than crashing mid-deck, so a transient credential-service hiccup does not abort a long run.

Elevation of Privilege

• Not applicable. The skill requests only synthesis; it performs no privilege transition and the endpoint scope is limited to Cognitive Services.

Risk Rating

Bucket B2: Environment and Entra credentials

Credentials are resolved per invocation. SPEECH_KEY is read from the environment; otherwise SPEECH_RESOURCE_ID triggers DefaultAzureCredential, which mints a short-lived token refreshed roughly five minutes before expiry. Nothing is persisted to disk.

Spoofing

• When both SPEECH_KEY and SPEECH_RESOURCE_ID are set, the skill warns and prefers key auth deterministically rather than silently choosing, so the active credential is unambiguous.

Tampering

• Not applicable. Credentials are read into memory per invocation and never written back, so there is no at-rest credential state to tamper with.

Repudiation

• Not applicable. Credential acquisition emits no skill-level audit record beyond the Azure SDK's own diagnostics.

Information Disclosure

• Short-lived Entra tokens are preferred over long-lived keys where the resource supports a custom domain and role assignment. Nothing is persisted to disk; credentials inherit whatever protection the process environment provides.

Denial of Service

• Token-refresh failures are caught and logged; the previously acquired token is retained rather than aborting the run.

Elevation of Privilege

• DefaultAzureCredential walks a broad credential chain (env, managed identity, Azure CLI, and more). In CI it may bind an unintended identity (G-EOP-1).

Risk Rating

Bucket B3: Untrusted content inputs

Spoofing

• Not applicable. Input content is parsed as data; no identity is derived from it.

Tampering

• SSML injection is mitigated: all dynamic values inserted into the SSML document — speaker notes, voice name, prosody rate, and acronym alias/replacement text — are XML-escaped or attribute-quoted before assembly. A single-pass regex prevents acronym substitution from corrupting previously inserted markup.

Repudiation

• Not applicable. No attribution is claimed over input content.

Information Disclosure

• Not applicable. The skill does not extract or forward secrets from input content; speaker-notes egress is covered under B1.

Denial of Service

• YAML inputs are parsed with yaml.safe_load; malformed slides are skipped with a warning rather than aborting the whole deck.

Elevation of Privilege

• YAML is parsed as data through safe_load; speaker notes and aliases are escaped before SSML assembly. The retired presentation parser introduces no remaining executable or archive-input surface.

Risk Rating

Bucket B4: CLI caller process and filesystem

The caller controls argv, environment, stdin, stdout, and stderr; the CLI treats that process as operator-controlled.

Spoofing

• Not applicable. The CLI runs as the invoking OS user and trusts the caller's argv and environment.

Tampering

• Argument paths are constrained to declared options. The caller selects the WAV output directory and is responsible for preserving existing outputs before intentional regeneration.

Repudiation

• The CLI returns deterministic exit codes so automation can attribute outcomes to the invoking step.

Information Disclosure

• Nothing is persisted to disk beyond the requested outputs; no credentials are written.

Denial of Service

• Partial WAV files left by a failed synthesis are removed rather than presented as completed narration.

Elevation of Privilege

• Output directories are created with default permissions; the skill performs no privileged operation.

Risk Rating

Enterprise Readiness Gaps

The following are known limitations recorded so operators can make informed deployment decisions. Severity ratings are the project's own assessment and are not equivalent to a CVSS score.

For an active issue tracker entry covering these gaps, see the hve-core issues list.

References

• STRIDE Threat Model

• OWASP Top 10 for LLM Applications

• Azure AI Speech security

• DefaultAzureCredential

• Repository security model

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.