Reiki by Web3Go — agentic threat model

Not certain from the listing — The specific foundation models utilized by Reiki are not disclosed. However, as a creator platform, it likely supports multiple third-party LLMs, exposing deployed agents to standard prompt injection, model alignment issues, and adversarial exploitation.

Not certain from the listing — The mechanisms for data operations, vector storage, and RAG are not detailed. There is a risk of data poisoning or intellectual property leakage if creators upload proprietary datasets to train or ground their marketplace agents.

Reiki provides pre-built components and customizable templates to orchestrate agent behavior. Vulnerabilities in these templates or insecure tool integrations could allow malicious users to hijack agent execution paths or abuse integrated APIs.

The platform hosts and deploys user-created agents. Without strict containerization and sandboxing, hosting user-generated agent code poses risks of privilege escalation, lateral movement, and infrastructure resource abuse.

Not certain from the listing — There is no mention of built-in evaluation, logging, or guardrail systems to monitor agent behavior, detect drift, or prevent malicious outputs post-deployment.

Security controls heavily emphasize on-chain ownership proof to protect intellectual property. However, traditional enterprise security controls, access management (IAM), and regulatory compliance frameworks are not highlighted.

As an AI agent marketplace, the ecosystem layer is highly critical. Risks include the distribution of rogue or backdoored agents, trust abuse between interacting agents, and cascading failures if a widely integrated marketplace agent is compromised.