Pipedrive (Composio MCP) — agentic threat model
This agent poses a high risk due to its direct write access (CRUD) to sensitive CRM data and sales PII, combined with managed OAuth credentials that could be abused via prompt injection or tool misuse.
OWASP AIVSS score rationale
| Autonomy of Action | 0.60 | |
| Goal-Driven Planning | 0.30 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.80 | |
| Persistent Memory | 0.10 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.70 | |
| Multi-Agent Interactions | 0.20 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.30 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — The agent relies on an external orchestrating LLM. Threats include prompt injection attacks that could trick the model into executing unauthorized CRM tool calls.
Not certain from the listing — No internal RAG or vector database is specified, but the agent directly queries and mutates structured CRM data (deals, persons, organizations) containing sensitive sales PII.
Exposes powerful Pipedrive API endpoints as MCP tools. Threats include tool misuse, where malicious inputs trigger unintended CRUD operations on pipelines, deals, or contacts.
Integrates with Composio's infrastructure to manage OAuth connections. Threats include credential exposure of Pipedrive OAuth tokens and potential host/platform compromise on the integration layer.
Not certain from the listing — No built-in transaction monitoring, guardrails, or audit logging are detailed to detect anomalous or malicious CRM mutations.
Relies on managed Pipedrive OAuth for authentication and authorization. Threats include privilege escalation if the OAuth token is granted excessive scopes beyond what the agent requires.
Not certain from the listing — While part of the Composio MCP ecosystem, specific multi-agent trust boundaries and cascading failure risks are not defined.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).