High-risk tools in Android
18 of the 23 tools in Android are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
actExecuteExecute a natural language action. The AI will plan and perform multi-step operations in a single invocation, useful for transient UI interactions (e.g., Spotlight, dropdown men...
-
android_connectExecuteConnect to Android device via ADB. If deviceId not provided, uses the first available device.
-
AndroidBackButtonExecuteAndroidBackButton action, Trigger the system "back" operation on Android devices
-
AndroidHomeButtonExecuteAndroidHomeButton action, Trigger the system "home" operation on Android devices
-
AndroidRecentAppsButtonExecuteAndroidRecentAppsButton action, Trigger the system "recent apps" operation on Android devices
-
CursorMoveExecuteCursorMove action, Move the text cursor (caret) left or right within an input field or text area. Use this to reposition the cursor without selecting text.. Parameters: directio...
-
DoubleClickExecuteDoubleClick action, Double click the element. Parameters: locate (object) - The element to be double clicked
-
DragAndDropExecuteDragAndDrop action, Pick up a specific UI element and move it to a new position (e.g., reorder a card, move a file into a folder, sort list items). The element itself moves with...
-
KeyboardPressExecuteKeyboardPress action, Press a key or key combination, like "Enter", "Tab", "Escape", or "Control+A", "Shift+Enter". Do not use this to type text.. Parameters: locate? (object) -...
-
LaunchExecuteLaunch action, Launch an Android app or URL. Parameters: uri (string) - App name, package name, or URL to launch. Prioritize using the exact package name or URL the user has pro...
-
LongPressExecuteLongPress action, Long press the element. Parameters: locate (object) - The element to be long pressed; duration? (number) - Long press duration in milliseconds
-
PinchExecutePinch action, Perform a two-finger pinch gesture. Use direction "in" to pinch fingers together (zoom out), or "out" to spread fingers apart (zoom in). Optionally specify distanc...
-
PullGestureExecutePullGesture action, Trigger pull down to refresh or pull up actions. Parameters: direction (enum('up', 'down')) - The direction to pull; distance? (number) - The distance to pul...
-
RunAdbShellExecuteRunAdbShell action, Execute an ADB shell command on the Android device and return the command stdout. Read the returned stdout to decide the next step; the stdout may indicate e...
-
ScrollExecuteScroll action, Scroll the page or a scrollable element to browse content. This is the preferred way to scroll on all platforms, including mobile. Supports scrollToBottom/scrollT...
-
SwipeExecuteSwipe action, Perform a touch gesture for interactions beyond regular scrolling (e.g., adjust a continuous control such as a slider, flip pages in a carousel, dismiss a notifica...
-
TapExecuteTap action, Tap the element. Parameters: locate (object) - The element to be tapped
-
TerminateExecuteTerminate action, Terminate (force-stop) an Android app by package name. Parameters: uri (string) - Package name or app name to terminate. Use the exact package name, e.g. com.a...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.