A city chatbot marketplace lists a plugin whose name nearly matches the official permitting helper. What ecosystem risk is that?
Select an answer to reveal the explanation.
Short Explanation
A look-alike permitting plugin name is typosquatting—trust bait in the marketplace. Verify publishers and names; permission scope creep, training data poisoning, or hidden prompt injection won't stop it.
Full Explanation
A city chatbot marketplace listing a plugin whose name nearly matches the official permitting helper presents typosquatting risk against civic AI plugin naming and marketplace trust. Near-identical names exploit staff and resident trust to install look-alike helpers that can steal prompts, session tokens, or permitting data once enabled inside municipal workflows. Assessments recommend publisher verification, exact-name and trademark controls, warning UX for look-alikes, signing requirements, and rapid removal of impersonating listings. Permission scope creep across civic chatbot plugin authorization flows, training data poisoning in permitting document corpora for retrieval tuning, and prompt injection via hidden instructions in plugin description fields are different risks; none of them is the look-alike naming problem in the question. Marketplace trust is part of the civic AI supply chain; none of these addresses typosquatting. Exam distractors focus on marketplace aesthetics; the correct ecosystem risk is typosquatting against official civic helpers. Caveat: defensive naming alone fails if installation still skips signature validation or publisher attestation checks for official plugins. Operational check: search the marketplace for near-matches to official permitting plugin names, flag impersonators for takedown, and verify official apps require verified publisher badges plus integrity checks before enablement.