← Sort Feed for TikTok and Instagram
Sort Feed for TikTok and Instagram — agentic threat model
The agent exhibits extremely low agentic risk, functioning primarily as a deterministic Chrome extension for DOM manipulation and data extraction rather than an autonomous AI agent. Its primary security risks stem from traditional browser extension vulnerabilities, such as potential data exfiltration or session hijacking if compromised.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.00 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.10 | |
| Persistent Memory | 0.00 | |
| Contextual Awareness | 0.10 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.00 | |
| Opacity & Reflexivity | 0.10 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The description does not mention any underlying LLM or foundation model; it appears to be a deterministic DOM-manipulation utility rather than an AI-driven agent.
Not certain from the listing — Operates locally on the visible browser DOM to extract metrics (views, likes, comments) and export CSVs; no centralized vector store, training data, or RAG operations are described.
Not certain from the listing — No agentic orchestration framework, planning, or tool-calling is mentioned; it functions as a standard, deterministic Chrome extension.
Not certain from the listing — Deployed as a client-side Chrome extension; security relies heavily on Chrome's extension sandboxing and permission model, though specific hosting or backend infrastructure is not detailed.
Not certain from the listing — No mention of AI evaluation, guardrails, or monitoring systems; likely relies on standard browser-level error logging if any.
Not certain from the listing — No explicit security certifications, compliance audits, or data privacy controls are detailed in the public listing.
Not certain from the listing — Does not interact with other AI agents or marketplaces; operates independently within the user's browser session.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).