Tutorly.sg — agentic threat model

Not certain from the listing — likely utilizes commercial LLMs (such as OpenAI or Anthropic) prompted for the Singapore MOE syllabus. The primary threat is prompt injection or jailbreaking, which could bypass safety guardrails and expose young students to inappropriate or non-educational content.

Not certain from the listing — relies on a knowledge base of Singapore MOE syllabus materials, past year exam papers, and student profiles. Threats include data poisoning of the educational content and unauthorized exfiltration of student performance data or PII.

Not certain from the listing — likely uses a basic RAG and orchestration framework to retrieve syllabus-compliant questions and generate quizzes. Threats include insecure tool integration if the quiz generator or paper retriever lacks strict input validation.

Not certain from the listing — presumably hosted on standard cloud infrastructure with web-based access. Threats include standard web application vulnerabilities (XSS, CSRF) and lack of sandboxing for dynamic content generation.

Not certain from the listing — no mention of automated guardrails, content moderation APIs, or continuous monitoring for LLM drift or toxic outputs, which is critical given the target audience of young students.

Not certain from the listing — must comply with Singapore's PDPA, especially regarding minors' data, but no specific compliance certifications (like SOC2) or age-verification controls are mentioned.

Not certain from the listing — appears to operate as a standalone single-agent tutor platform with no multi-agent or external marketplace integrations described.