Critical-risk tools in ProAgentStore
24 of the 243 tools in ProAgentStore are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancel_instance_taskDestructiveCancel a task on the registered local or managed browser runtime for a private instance.
-
clear_finished_tasksDestructiveclear_finished_tasks
-
clear_instance_messagesDestructiveClear a subscribed instance
-
clear_instance_voice_settingsDestructiveDrop a subscribed instance
-
coding_loop_queue_cancelDestructiveWithdraw a queued objective before it starts. Takes the
-
coding_repo_removeDestructiveDetach a repo from a coding instance — the counterpart to coding_repo_add, and the way to clean up a binding that was added in error or whose local checkout no longer exists. Id...
-
delete_agentDestructivePermanently delete one of YOUR OWN agent TEMPLATES. This also removes the creator
-
delete_agent_knowledgeDestructivePermanently remove one knowledge document from an agent TEMPLATE. This changes what new subscribers can receive; it does not edit existing instances. Read the template
-
delete_agent_taskDestructiveRemove a standing task from an instance
-
delete_connectionDestructiveDelete an event connection for good. This destroys the edge
-
delete_feedbackDestructivePermanently delete one feedback row — the owner
-
delete_instance_connector_grantDestructiveRevoke an instance
-
delete_instance_fileDestructiveDelete an uploaded file from a subscribed instance (Knowledge → Files). Removes the R2 object, its metadata, and its vectors.
-
delete_instance_knowledgeDestructiveDelete a knowledge document from your private subscribed instance.
-
delete_instance_memoryDestructiveDelete one memory entry (by key) from a subscribed instance.
-
delete_instance_messageDestructivePermanently delete the conversational turn containing one message from a subscribed instance. This can remove paired user/assistant messages and attached voice audio, but cannot...
-
delete_instance_taskDestructiveDelete a ticket from a private instance
-
delete_instance_triggerDestructiveDelete a configured instance trigger. This removes its event history and connector sync ledger.
-
delete_supervisionDestructiveRemove a supervision link so the supervisor can no longer delegate to that agent. Destructive and silent: afterwards the supervisor does not error, the subordinate simply become...
-
forget_runner_nodeDestructivePermanently remove a disconnected machine
-
remove_repoDestructiveRemove one indexed repository from a repo-chat instance (by repo_url or owner/repo), or all of them if neither is given. Deletes its vectors and overview.
-
unregister_instance_runtimeDestructiveRemove the registered runtime endpoint for one of your private instances.
-
cancel_instanceFinancialCancel your subscription and deactivate one private subscribed instance.
-
set_budget_limitsFinancialPatch your per-account AI-spend limits — the two daily circuit breakers and the four per-tree run knobs. Only the fields you pass are changed; anything you omit keeps its stored...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.