Acedit — agentic threat model
Acedit is a low-risk, vertical AI coaching agent primarily handling text-based mock interviews and resume analysis. Its main security exposures lie in the handling of user PII (resumes) and the potential for prompt injection, with minimal risk of autonomous real-world harm.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.30 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.10 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.60 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely relies on commercial or open-source LLMs (e.g., GPT-4, Llama) for generating interview questions and feedback. Risks include prompt injection to bypass coaching guardrails or generate inappropriate content.
Not certain from the listing — likely processes user-uploaded resumes and job descriptions to tailor mock interviews. Risks include data exfiltration of sensitive PII contained in resumes, or poisoning of the mock interview context.
Not certain from the listing — likely uses a standard orchestration framework (e.g., LangChain) to manage the mock interview flow. Risks include insecure state management or session hijacking during real-time support.
As an open-source tool, deployment depends on the user's hosting choice or a central hosted version. Risks include insecure default configurations in self-hosted environments or exposed API keys.
Not certain from the listing — no explicit mention of evaluation or observability guardrails. Risks include lack of monitoring for toxic or biased feedback generated during mock interviews.
Not certain from the listing — compliance posture (e.g., GDPR for resume data) is unspecified. Risks include non-compliance with data privacy regulations if user resumes are stored without proper consent or encryption.
The agent operates as a standalone vertical application with no indicated multi-agent or marketplace integrations, minimizing ecosystem-level cascading risks.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).