Critical-risk tools in EasyBits
35 of the 273 tools in EasyBits are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
agent_destroyDestructiveDestroy a persistent agent created via
-
agent_run_destroyDestructiveDestroy the sandbox underlying an agent run. Call this after you
-
bulk_delete_filesDestructiveSoft-delete multiple files at once (max 100). Returns count of deleted files.
-
call_destroyDestructiveTermina una videollamada limpiamente: (1) para la grabación activa si la hay y sube el MP4 a Files, (2) rescata cualquier grabación huérfana en la VM y la sube, (3) destruye el ...
-
character_deleteDestructiveDelete a saved character. Only removes the Character record — the reference photos (if stored as Files) stay in the user
-
db_deleteDestructivePermanently delete a database and all its data.
-
delete_ai_keyDestructiveRemove a stored AI provider API key
-
delete_brand_kitDestructiveDelete a brand kit.
-
delete_documentDestructiveDelete a document permanently.
-
delete_domainDestructiveRemove a custom domain: unlinks its websites and deletes its certificates. Returns
-
delete_fileDestructiveSoft-delete a file (sets status to DELETED). Recoverable for 7 days via
-
delete_machine_releaseDestructiveDelete a release and its stored artifact. Refuses if it is the release currently deployed on a live machine.
-
delete_pageDestructiveDelete a page from a document by its section ID. Cannot delete the last remaining page.
-
delete_snapshotDestructiveDelete a sandbox snapshot, freeing its stored image. Does not affect the source box or any children already forked from it.
-
delete_video_projectDestructiveDelete a video project permanently.
-
delete_video_sceneDestructiveDelete a scene by id.
-
delete_webhookDestructivePermanently delete a webhook.
-
delete_websiteDestructiveDelete a website. Soft-deletes all associated files (recoverable for 7 days) and removes the website record.
-
generate_share_tokenDestructiveGenerate a temporary public URL for a private file — perfect for sharing previews without making the file permanently public. Returns
-
release_machineDestructiveDelete an always-on machine. DESTRUCTIVE AND IMMEDIATE: stops billing, takes a last backup and destroys the VM — there is no grace period and no undo. The backup is kept 7 days ...
-
revoke_accessDestructiveRevoke delegated access from an account by email. Omit scopes to revoke everything; pass scopes to remove only those. Idempotent.
-
revoke_permissionDestructiveRevoke a file sharing permission by ID. You must own the file.
-
revoke_share_linkDestructiveRevoke a share link by ID. The link stops working immediately for new requests; cached pages may still render briefly.
-
revoke_share_tokenDestructiveRevoke (delete) a share token, invalidating its URL.
-
sandbox_delete_template_snapshotDestructiveDelete a derived template by derivedId. Fails with 409 DerivedTemplateInUse while children created from it are alive (starting/running/suspended) — destroy them first. Does not ...
-
sandbox_destroyDestructivePermanently destroy an EPHEMERAL sandbox and free its resources. Idempotent. (Permanent machines are released via release_machine, which soft-deletes.)
-
sandbox_domain_removeDestructiveDetach a custom domain from a sandbox.
-
sandbox_files_deleteDestructiveDelete a file or directory inside the sandbox. Pass recursive=true to remove a non-empty directory.
-
sandbox_unexpose_raw_portDestructiveTear down a raw TCP/UDP forward created with sandbox_expose_raw_port. The host port returns to the pool and may be re-assigned to another box.
-
secret_deleteDestructiveDelete an EasyBits Secret by name. Any pending or future
-
service_stopDestructiveDetiene y destruye una caja de servicio de flota para liberar recursos. Pasa el sandboxId devuelto por service_start. Si no se llama, la caja se auto-destruye por idle (~10 min)...
-
unpublish_documentDestructiveUnpublish a document, removing its website and reverting to draft status.
-
create_machineFinancialBuy an ALWAYS-ON machine (permanent VM, flat MXN/month). NO platform plan needed — hosting bills on its own. If the account has an active plan the machine is provisioned right a...
-
create_payment_linkFinancialCreate a MercadoPago payment link (Checkout Pro). Returns a shareable initPoint URL. Requires the user to have connected their MercadoPago account at /dash/developer/payments. M...
-
make_permanentFinancialPromote an existing (ephemeral) sandbox to an always-on machine: keeps the SAME sandboxId, disarms the host reaper, and starts flat MXN/month billing for the chosen tier. The
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.