remio — agentic threat model

Not certain from the listing — the specific LLMs used for search, summarization, and generation are not disclosed. The primary model-level threat is indirect prompt injection, where malicious instructions embedded in captured web pages manipulate the model's output during summarization or search.

The agent relies on a local knowledge base populated by auto-capturing web browsing and user highlights. This creates a high risk of local data poisoning if malicious or deceptive web content is ingested, potentially corrupting future search results and recommendations.

Not certain from the listing — the orchestration framework connecting the browser extension to the local storage and LLM is proprietary. Potential threats include insecure tool integration between the browser's DOM parser and the local RAG pipeline.

Deployed as a browser extension with local-first storage. The primary infrastructure threats involve local database compromise (unencrypted SQLite/Vector files on the host) and extension-level privilege escalation allowing unauthorized access to broader browser data.

Not certain from the listing — there is no mention of local guardrails, input filtering, or logging mechanisms to detect anomalous inputs or malicious payloads within captured web pages.

Not certain from the listing — while 'local-first' is promoted as a privacy control, there is no mention of formal compliance standards, data encryption at rest, or access control policies governing the local database.

The agent operates as a standalone personal assistant with no multi-agent coordination or marketplace ecosystem described, minimizing ecosystem-level cascading failures.