Clippy AI — agentic threat model
Clippy AI presents a moderate security risk primarily driven by its Slack integration and RAG-based knowledge base, which are susceptible to prompt injection and data exfiltration, though mitigated by human-in-the-loop handoffs for complex queries.
OWASP AIVSS score rationale
| Autonomy of Action | 0.50 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.10 | |
| Dynamic Tool Use | 0.30 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The underlying foundation model is not specified. Standard LLM risks apply, including prompt injection that could bypass canned responses or cause the bot to output misaligned or brand-damaging content.
The agent relies heavily on a user-provided knowledge base (FAQs and company info). This introduces risks of knowledge-base poisoning if unauthorized users can modify the FAQs, or data exfiltration if sensitive internal documents are uploaded and leaked via prompt injection.
The orchestration framework manages conversation flow, canned responses, and human handoff. Vulnerabilities include prompt injection manipulating the handoff logic (e.g., preventing handoff to keep a user trapped with the bot, or forcing premature handoffs to flood human agents).
Not certain from the listing — As a closed-source SaaS platform, the hosting, sandboxing, and network isolation details are unknown. Risks include tenant isolation failure or insecure API endpoints connecting the chatbot to the Slack workspace.
Not certain from the listing — While 'AI Training' is mentioned, there is no explicit detail on real-time guardrails, logging, or drift detection. This creates a blind spot where malicious interactions or prompt injection attempts may go undetected.
Not certain from the listing — No compliance certifications (e.g., SOC2, GDPR) or role-based access controls (RBAC) for the admin panel are detailed. A lack of strong admin authentication could allow attackers to alter the bot's training data.
The agent integrates directly into the Slack ecosystem. A compromise of the Slack workspace or a rogue user within the workspace could abuse the bot to extract proprietary knowledge base data or conduct internal phishing campaigns.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).