Zivy — agentic threat model

Not certain from the listing — likely relies on commercial LLMs for categorization. The primary threat is indirect prompt injection, where a malicious Slack message received by the user manipulates the underlying model to misclassify messages or exfiltrate data.

Not certain from the listing — requires ingestion and indexing of all incoming Slack messages and user feedback. Threats include data poisoning of the personalization database and unauthorized access to cached message content.

Not certain from the listing — orchestrates Slack reading, Google Calendar task creation, and snooze actions. Vulnerabilities include insecure tool integration where manipulated inputs trigger unauthorized calendar events or message actions.

Not certain from the listing — likely hosted as a cloud SaaS. Compromise of the hosting infrastructure or secrets storage would expose highly sensitive Slack and Google OAuth tokens.

Not certain from the listing — requires robust monitoring to ensure personalization does not drift or silently suppress critical messages. Gaps in observability could lead to undetected data loss or communication failures.

Not certain from the listing — demands high-privilege OAuth access to Slack and Google Workspace. Without strict compliance frameworks and granular access controls, this creates a massive compliance and privacy liability.

Not certain from the listing — primarily acts as a single-agent integration. However, interactions with other automated Slack bots or agents could lead to cascading prompt injection or trust-abuse loops.