DearFlow — agentic threat model

Not certain from the listing — The underlying foundation models are unspecified. The primary threat is indirect prompt injection, where malicious instructions embedded in incoming emails hijack the model's output generation or tool-calling behavior.

Not certain from the listing — The agent acts as a 'Documents Keeper' and monitors emails/calendars, implying local storage or vector databases for user data. Threats include unauthorized data exfiltration of sensitive documents and lack of data lineage controls.

Flora orchestrates email monitoring, auto-drafting, and inbox cleanup. The orchestration framework is highly vulnerable to tool misuse (e.g., deleting emails or unsubscribing from legitimate services) triggered by adversarial email content.

Not certain from the listing — The hosting and sandboxing environment for this closed-source, freemium SaaS is unknown. A compromise at this layer could expose OAuth tokens allowing full access to users' inbox and calendar providers.

Not certain from the listing — There is no mention of real-time guardrails, input filtering, or transaction logging to detect and block malicious prompt injections before they trigger automated email drafts or cleanup actions.

The agent requires extensive read/write/delete OAuth permissions to manage emails, calendars, and documents. As a closed-source freemium tool with no cited security compliance (e.g., SOC2), it poses significant supply-chain and data-privacy risks.

Not certain from the listing — While primarily a single-agent assistant, it operates within the broader email ecosystem, making it a target for external automated agents sending malicious payloads to trigger cascading actions in the user's inbox.