AiderDesk — agentic threat model

Not certain from the listing — AiderDesk is model-agnostic and relies on external LLMs via Aider; threats include prompt injection leading to unauthorized execution of registered slash-commands or tools.

Not certain from the listing — The tool operates on local workspace files (e.g., onFileAdded hook); threats include local data exfiltration or unauthorized file modification via malicious prompt injection.

High risk. The framework exposes 30+ lifecycle hooks (onTaskCreated, onToolCalled) and allows TypeScript extensions to register custom tools and slash-commands, creating a massive attack surface for tool misuse and arbitrary code execution.

High risk. As a desktop orchestration app, extensions and tools run locally on the user's machine. Without explicit sandboxing mentioned, compromised extensions can achieve full local host compromise and privilege escalation.

Not certain from the listing — While lifecycle hooks (onToolCalled) exist and could theoretically be used for logging, there is no mention of built-in security guardrails, evaluation, or anomaly detection.

Not certain from the listing — No built-in authentication, authorization, or policy enforcement mechanisms are described for restricting what extensions or tools can execute on the host system.

High risk. The extension ecosystem allows custom agent profiles and third-party TypeScript plugins. A malicious or compromised plugin in the ecosystem can intercept core events and execute arbitrary background scripts.