Critical-risk tools in Pixi Inspector
11 of the 63 tools in Pixi Inspector are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cdp.console.startDestructiveAttaches the debugger (held) and enables Runtime + Log capture (console.* calls, browser log entries, and uncaught exceptions) into a bounded ring buffer. Idempotent. Auto-stops...
-
cdp.emulate.cpuDestructiveEmulation.setCPUThrottlingRate (1 = no throttle, 4 = 4× slowdown). HELD override: the attach banner stays until cdp.emulate.clear. Auto-cleared on detach / idle / connector-off ...
-
cdp.emulate.deviceDestructiveEmulation.setDeviceMetricsOverride (resizes the viewport). HELD override: the attach banner stays until cdp.emulate.clear. Auto-cleared on detach / idle / connector-off so the p...
-
cdp.emulate.networkDestructiveNetwork.emulateNetworkConditions (enables the Network domain if no capture session already has; outlives cdp.network.stop). HELD override: the attach banner stays until cdp.emul...
-
cdp.emulate.touchDestructiveEmulation.setTouchEmulationEnabled. HELD override: the attach banner stays until cdp.emulate.clear. Auto-cleared on detach / idle / connector-off so the page is never left stuck...
-
cdp.network.startDestructiveAttaches the debugger (held) and enables Network domain capture into a bounded ring buffer. Idempotent. The attach banner stays until cdp.network.stop. Auto-stops after ~5 min i...
-
cdp.network.stopDestructiveStops Network capture and releases the session hold (detaches the debugger if it was the last holder — banner disappears). Active cdp.emulate.network throttling stays in effect ...
-
cdp.performance.trace.startDestructiveStarts a HELD, time-boxed Chrome tracing session (Tracing.start). The attach banner stays until cdp.performance.trace.stop or the maxDurationMs cap auto-ends it. Raw events buff...
-
ext.logsDestructiveOWNER-ONLY. Returns recent service-worker console output from a bounded in-memory ring buffer (drop-oldest). UNAUTHORIZED unless that browser is paired. Runs in one browser: `ta...
-
pixi.tree.highlightDestructiveHighlights a node on the canvas. Pass id=null to clear the highlight. Draws nothing while the user has the overlay switched off in the panel (the eye button above the tree).
-
use_targetDestructivePins the tab every later page/browser/cdp call in THIS session acts on, and remembers it until the tab goes away or you change it. Call this after a CHOOSE_TARGET error: show th...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.