Mokaru — agentic threat model

Not certain from the listing — likely utilizes third-party LLMs via API to perform resume tailoring and ATS analysis. Primary threats include prompt injection via adversarial job descriptions or resumes designed to hijack the model's output or bypass ATS screening rules.

Not certain from the listing — processes highly sensitive Personally Identifiable Information (PII) contained within user resumes (names, contact details, employment history). Key threats include insecure storage of uploaded documents, lack of data minimization, and potential leakage of user data if used for downstream model fine-tuning.

Not certain from the listing — orchestration appears limited to simple document parsing and prompt templating. The main threat is insecure integration of file parsers (e.g., PDF/DOCX extractors) which could be vulnerable to local file inclusion or buffer overflow attacks.

Not certain from the listing — likely deployed as a standard SaaS web application. Threats include typical OWASP Top 10 vulnerabilities, insecure file upload mechanisms allowing malicious payloads to be executed on the server, and lack of sandboxing during document parsing.

Not certain from the listing — no observability or guardrail mechanisms are mentioned. Gaps in logging and monitoring could allow attackers to systematically scrape job descriptions or abuse the free ATS checker without detection.

Not certain from the listing — handling job seeker data requires strict adherence to privacy regulations like GDPR and CCPA. The absence of stated compliance certifications (e.g., SOC 2) or explicit data retention policies represents a significant compliance risk.

Not certain from the listing — operates as a standalone horizontal platform with no indicated multi-agent coordination or external marketplace integrations, resulting in minimal ecosystem-level threat exposure.