Body Shape Calculator — agentic threat model
The Body Shape Calculator is a low-autonomy, single-purpose utility with minimal agentic risk, but it carries high privacy and compliance risks due to the processing of sensitive user body photos without registration or explicit security controls.
OWASP AIVSS score rationale
| Autonomy of Action | 0.10 | |
| Goal-Driven Planning | 0.00 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.10 | |
| Persistent Memory | 0.00 | |
| Contextual Awareness | 0.10 | |
| Dynamic Identity | 0.00 | |
| Multi-Agent Interactions | 0.00 | |
| Non-Determinism | 0.20 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — likely uses a computer vision or multimodal foundation model to analyze body proportions. Threats include adversarial image perturbations that trick the model into incorrect classifications or model extraction attacks.
Not certain from the listing — processes uploaded user images. Since no registration is required, data is likely processed ephemerally, but there is a risk of image caching, data leakage, or unauthorized retention of sensitive body photos.
Not certain from the listing — likely a simple pipeline rather than a complex agentic framework. Risks of tool misuse are low, but insecure handling of image file uploads (e.g., remote code execution via malicious image metadata) is a threat.
Not certain from the listing — hosted as a web application. Threats include server-side request forgery (SSRF) via image URLs if URL upload is supported, or standard web application vulnerabilities allowing access to the underlying hosting environment.
Not certain from the listing — no visible monitoring or guardrails. Gaps in observability could allow attackers to upload abusive/NSFW content undetected or perform high-volume scraping of the service.
No registration required and closed source. This presents significant compliance risks under GDPR/CCPA regarding biometric data and consent, as there are no explicit identity or access management controls visible.
This is a standalone, single-purpose utility with no multi-agent or ecosystem integration described, making ecosystem-level threats (like cascading agent failures) non-applicable.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).