Wigoo With Go — agentic threat model
Wigoo With Go is a specialized AI shopping assistant for Tesla camping gear with low agentic risk, primarily acting as a recommendation engine with minimal autonomous execution capabilities.
OWASP AIVSS score rationale
| Autonomy of Action | 0.30 | |
| Goal-Driven Planning | 0.20 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.20 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.10 | |
| Non-Determinism | 0.40 | |
| Opacity & Reflexivity | 0.30 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely utilizes a standard commercial or open-source LLM to parse user queries about Tesla camping. It is vulnerable to prompt injection that could hijack the assistant to recommend competitor products or output malicious links.
Not certain from the listing — relies on a product database or vector store containing Tesla accessory specifications. Vulnerable to data poisoning where malicious product listings or incorrect dimensions are injected into the catalog.
Not certain from the listing — likely uses basic search and retrieval tools to match user requests with inventory. Insecure tool integration could allow parameter tampering during product queries.
Not certain from the listing — hosted as a standard web application or e-commerce plugin. Standard web application vulnerabilities (OWASP Top 10) apply to the hosting infrastructure.
Not certain from the listing — no details on guardrails or observability are provided. Lacks visible mechanisms to detect drift, hallucinated product specs, or adversarial inputs.
Not certain from the listing — no compliance certifications (e.g., SOC2, GDPR) or robust identity management controls are specified for handling user shopping preferences or potential transaction data.
Not certain from the listing — operates primarily as a standalone horizontal shopping agent, but could face ecosystem risks if integrated directly with external e-commerce platforms or payment APIs.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).
These scores are auto-generated from public information (the agent's own listing, docs, and repository) using the canonical OWASP AIVSS formula and the MAESTRO framework — an estimate for guidance, not a penetration test, audit, or certification. See the scoring methodology. Are you the vendor? Factual corrections are free.