Critical-risk tools in FeatureBoard
15 of the 215 tools in FeatureBoard are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancel_bookingDestructiveCancel a scheduled booking by id (from list_bookings), optionally with a reason. Idempotent: cancelling an already-cancelled booking is a no-op.
-
cleanup_worktreeDestructiveRemove a ticket
-
delete_taskDestructivePermanently remove a task from its board.
-
prune_boardDestructiveGuarded cleanup: deletes ONLY the ticket ids you pass, and only when confirm is true (otherwise returns a dry-run preview of what would be deleted). Non-existent ids are reporte...
-
remove_annotationDestructiveRemove an annotation from an asset by its id (from get_media). Returns the remaining count.
-
remove_attachmentDestructiveDetach a previously attached file path or URL from a ticket.
-
remove_company_agreementDestructiveDelete a contract/license from a company by id.
-
remove_contactDestructiveRemove a contact from a company by its contact id (e.g. c1).
-
remove_media_commentDestructiveRemove a comment by id (from get_media / list_media_comments). By default its reply subtree is removed too; set cascade:false to refuse when it still has replies. Returns the id...
-
remove_pageDestructiveDelete a sub-page (by slug) and its rendered file. The home page can
-
remove_productDestructiveRemove a product from a board
-
remove_shareDestructiveDelete a share draft by its id (from list_shares).
-
remove_test_pageDestructiveDelete a test page by name.
-
activate_licenseFinancialActivate a commercial license. Two modes — provide exactly one: (1)
-
request_commercial_licenseFinancialStart the commercial licensing process. Records the request locally (for the licensor
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.