High-risk tools in Cloudflare
4 of the 98 tools in Cloudflare are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
container_execExecuteRun a command in a container and return stdout. If necessary, set a timeout. To debug, stream back standard error. For Python, always use python3 and pip3.
-
container_initializeExecuteStart or restart the container. Use this tool to initialize a container before running any Python or Node.js code that the user requests to run.
-
dex_create_remote_pcapExecuteCreate a remote packet capture (PCAP) for a device. This is a resource intensive and privacy-sensitive operation on a real user device.
-
dex_create_remote_warp_diagExecuteCreate a remote Warp Diagnostic (WARP-diag) for a device. This is a resource intensive and privacy-sensitive operation on a real user device.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.