Artha Job Board — agentic threat model
Artha Job Board presents low agentic risk due to its limited autonomy and planning capabilities, operating primarily as a standard SaaS job board. However, the integration of APIs and administrative interfaces handling candidate PII introduces traditional web application and data privacy risks.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.20 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.20 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.20 | |
| Opacity & Reflexivity | 0.20 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The listing does not specify which LLMs or foundation models are used for the recruiting or matching features. Potential threats include prompt injection if users can search or upload resumes parsed by an LLM.
Not certain from the listing — The job board handles applicant resumes, job descriptions, and user profiles. Threats include data exfiltration of PII and potential training data poisoning if resume data is used to fine-tune matching models.
Not certain from the listing — Orchestration details are not provided. If an agent framework is used to match candidates, insecure tool integration via the API could lead to unauthorized data access.
Not certain from the listing — Hosted as a SaaS job board with an API. Standard threats include container compromise, API key exposure, and unauthorized access to the administrative interface.
Not certain from the listing — No mention of evaluation, monitoring, or guardrails for the AI recruiting features. Gaps could lead to biased matching or undetected prompt injections.
Not certain from the listing — No explicit security certifications (e.g., SOC2, GDPR compliance for candidate PII) are mentioned. Access control to the robust administrative interface is critical.
Not certain from the listing — The agent appears to operate as a standalone SaaS/API tool rather than interacting in a multi-agent ecosystem.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).