AgentReadyHomeAgent Listing

← XreplyAI

XreplyAI — agentic threat model

5.3AIVSS 5.3 · Medium

XreplyAI is a low-autonomy writing assistant designed to generate personalized Twitter/X replies. Its primary security risks stem from potential prompt injection via analyzed external tweets and the exposure of social media API keys or session credentials.

OWASP AIVSS score rationale

AIVSS = (CVSS_Base + AARS) × Mitigation_Factor, where AARS = (10 − CVSS_Base) × (Factor_Sum / 10) × ThM
CVSS base 5.5AARS uplift 1.08Factor sum 2.4/10Threat ×1.0Mitigation ×0.8
Autonomy of Action
0.20
Goal-Driven Planning
0.10
Self-Modification
0.00
Dynamic Tool Use
0.10
Persistent Memory
0.40
Contextual Awareness
0.50
Dynamic Identity
0.20
Multi-Agent Interactions
0.00
Non-Determinism
0.60
Opacity & Reflexivity
0.30

Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.

MAESTRO 7-layer threat model

Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.

L1 · Foundation Models⚠ not certain from listing

Not certain from the listing — likely utilizes commercial LLMs via API. The primary threat is indirect prompt injection, where malicious tweets analyzed by the agent manipulate the model into generating offensive or phishing replies.

L2 · Data Operations⚠ not certain from listing

Not certain from the listing — ingests 50-1000+ tweets to construct a voice profile. Threats include data poisoning if the source tweets contain malicious instructions, and unauthorized access to the stored voice profile data.

L3 · Agent Frameworks⚠ not certain from listing

Not certain from the listing — likely uses a lightweight orchestration framework to combine the voice profile, custom rules (up to 500 characters), and target tweet context. Insecure handling of custom rules could lead to system prompt leakage.

L4 · Deployment & Infrastructure⚠ not certain from listing

Not certain from the listing — hosted as a closed-source SaaS. The critical threat is the compromise of the hosting environment, which could expose users' Twitter/X API keys, OAuth tokens, or session data.

L5 · Evaluation & Observability⚠ not certain from listing

Not certain from the listing — no built-in guardrails or content moderation filters are mentioned. The agent relies heavily on the user ('Try Again Feature') to manually filter out inappropriate or brand-damaging outputs.

L6 · Security & Compliance (cross-cutting)⚠ not certain from listing

Not certain from the listing — lacks explicit details on data privacy, GDPR compliance, or secure OAuth token management for Twitter/X integrations.

L7 · Agent Ecosystem✓ mapped

The agent operates as a standalone productivity tool for a single user's social media account. It does not interact with other agents or participate in an agent marketplace, minimizing ecosystem-level cascading risks.

MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).