Dosu — agentic threat model

Not certain from the listing — likely relies on commercial LLMs. The primary threat is indirect prompt injection, where malicious users submit GitHub issues containing adversarial instructions designed to hijack Dosu's behavior.

Not certain from the listing — processes repository code, issues, and documentation as its primary data source. Threats include knowledge-base poisoning via malicious pull requests and potential exfiltration of private repository contents if integrated with private codebases.

Dosu orchestrates issue triage, commenting, and documentation updates. Vulnerabilities in its tool-calling framework could allow an attacker to manipulate GitHub API calls, leading to unauthorized issue closures, spamming, or unauthorized documentation modifications.

Not certain from the listing — hosted as a closed-source SaaS integration. A critical threat is the compromise of Dosu's hosting infrastructure, which could expose GitHub OAuth tokens or App private keys, granting attackers broad access to connected repositories.

Not certain from the listing — monitoring and guardrails are unspecified. Without robust logging and anomaly detection, stealthy prompt injection attacks or automated loops of incorrect triage actions could persist undetected.

Requires write permissions to GitHub issues, metadata, and potentially repository contents. The listing does not cite security compliance certifications (e.g., SOC2), posing compliance risks for enterprises integrating it into proprietary workflows.

Operates within the GitHub ecosystem alongside other developer tools. Threats include cascading feedback loops or trust abuse if other automated bots or CI/CD agents trigger or are triggered by Dosu's automated comments and issue updates.