High-risk tools in CoWork OS
74 of the 342 tools in CoWork OS are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
blender.render_viewExecuteRender a camera view to an image
-
browser_act_batchExecuteExecute a batch of browser actions in sequence. Use for multi-step interactions (e.g. fill form, click submit, wait for result).
-
browser_attachExecuteAttach to an existing Chrome browser session via Chrome DevTools Protocol.
-
browser_backExecuteGo back in browser history
-
browser_clickExecuteClick on an element on the page
-
browser_closeExecuteClose the browser
-
browser_close_tabExecuteClose a browser tab by tab id
-
browser_dragExecuteDrag from one Browser V2 snapshot ref to another
-
browser_emulateExecuteSet the visible in-app browser viewport/device emulation for responsive testing.
-
browser_evaluateExecuteExecute JavaScript code in the browser context
-
browser_fillExecuteFill a form field with text
-
browser_forwardExecuteGo forward in browser history
-
browser_handle_dialogExecuteAccept or dismiss the latest JavaScript dialog in the browser
-
browser_hoverExecuteMove the browser pointer over an element, preferably by browser_snapshot ref
-
browser_navigateExecuteNavigate the browser to a URL. By default, CoWork uses background/headless browser control unless settings or the tool input request a visible workbench.
-
browser_pressExecutePress a keyboard key (e.g., Enter, Tab, Escape)
-
browser_reloadExecuteReload the current page
-
browser_scrollExecuteScroll the page
-
browser_selectExecuteSelect an option from a dropdown
-
browser_switch_tabExecuteSwitch to a browser tab by tab id
-
browser_trace_startExecuteStart a lightweight browser trace for diagnostics
-
browser_trace_stopExecuteStop the active lightweight browser trace
-
browser_typeExecuteType text character by character (useful for search boxes with autocomplete)
-
browser_waitExecuteWait for an element to appear on the page
-
canvas_evalExecuteExecute JavaScript code in the canvas context.
-
canvas_open_urlExecuteOpen a remote web page inside the canvas window for full in-app browsing.
-
canvas_showExecuteOPTIONAL: Open the canvas in a separate interactive window.
-
clickExecuteClick inside the current controlled window using screenshot-relative coordinates.
-
cloud_sandbox_createExecuteCreate a new cloud sandbox (Linux VM). Returns sandbox ID and connection info.
-
cloud_sandbox_execExecuteExecute a shell command in a cloud sandbox. Returns stdout, stderr, and exit code.
-
comfyui.submit_flux_photoreal_passExecuteSubmit a Flux-style photoreal workflow graph with project metadata
-
comfyui.submit_workflowExecuteSubmit a ComfyUI workflow JSON graph
-
compile_latexExecuteCompile a workspace .tex file into a PDF using a system LaTeX engine.
-
double_clickExecuteDouble-click inside the current controlled window using screenshot-relative coordinates. Returns a fresh screenshot.
-
dragExecuteDrag through a series of screenshot-relative points inside the current controlled window. Returns a fresh screenshot.
-
execute_codeExecuteExecute Python, JavaScript, or shell code in a sandboxed process with a configurable timeout.
-
generate_imageExecuteGenerate an image from a text description using AI. CoWork OS will pick the best configured provider by default (Gemini/OpenAI/ChatGPT Subscription/Azure/OpenRouter), unless you...
-
generate_narration_audioExecuteGenerate narrated MP3 audio from text using the configured voice service.
-
generate_videoExecuteGenerate a video from a text prompt (or an image/video reference) using AI. CoWork OS will pick the best configured provider automatically (OpenAI Sora 2 / Azure Sora 2 / Gemini...
-
git_merge_to_baseExecuteMerge the current worktree branch back to the base branch. Only available in worktree isolation mode. Use when your work is complete and ready to be integrated.
-
google-workspace.slides_batch_updateExecuteRun raw Google Slides presentations.batchUpdate requests for advanced edits
-
http_requestExecuteMake HTTP requests like curl. Supports all HTTP methods, custom headers, and request bodies.
-
keypressExecuteSend a key or key chord to the current controlled window. Modifier keys: cmd/command on macOS, win/windows on Windows, ctrl/control, alt/option, shift. Returns a fresh screenshot.
-
mention_agentExecuteMention another specialized agent to request help, delegate work, request a review, or share information.
-
monty_runExecuteRun deterministic, sandboxed Python-subset code (Monty) for fast local computation and post-processing.
-
monty_run_transformExecuteRun a named workspace transform from .cowork/transforms/<name>.monty. The input object is available as
-
monty_transform_fileExecuteRead a text file, run a named workspace transform, and write the result to an output file, returning only a small summary.
-
move_mouseExecuteMove the pointer inside the current controlled window using screenshot-relative coordinates. Returns a fresh screenshot.
-
node_camera_snapExecuteTake a photo using a mobile companion
-
node_sms_sendExecuteSend an SMS message using an Android mobile companion device. Not available on iOS.
-
open_applicationExecuteOpen an application by name (e.g.,
-
open_pathExecuteOpen a file or folder with the system default application
-
open_urlExecuteOpen a URL in the default web browser
-
orchestrate_agentsExecuteSpawn multiple sub-agents in parallel and wait for all of them to complete.
-
pause_agentExecutePause a running descendant child agent task. This tool only works for tasks spawned by the current task (descendants).
-
qa_checkExecuteRun a specific QA check on the current page.
-
qa_interactExecutePerform an interaction on the current QA page (click, fill, hover, scroll, wait).
-
qa_navigateExecuteNavigate the QA browser to a URL and get a page state report.
-
qa_runExecuteRun a full automated QA pipeline on a web app using Playwright.
-
resume_agentExecuteResume a paused descendant child agent task. This tool only works for tasks spawned by the current task (descendants).
-
rhino.generate_massingExecuteGenerate building massing from the brief and constraints
-
run_applescriptExecuteExecute exact AppleScript / osascript code on macOS.
-
run_commandExecuteExecute a shell command in the workspace directory. IMPORTANT: This tool requires user approval before execution. The user will see the command and can approve or deny it. Use t...
-
schedule_taskExecuteSchedule a task to run at a specific time or on a recurring basis.
-
scrape_sessionExecuteRun a multi-step scraping session with persistent browser state.
-
scrollExecuteScroll at a screenshot-relative point inside the current controlled window. scrollX and scrollY are signed line deltas. Returns a fresh screenshot.
-
show_in_folderExecuteShow a file in the system file manager (Finder on macOS, Explorer on Windows)
-
SkillExecuteInvoke a skill by ID when one clearly matches the task. If a matching skill exists, call Skill before using other tools or drafting the final answer.
-
spawn_agentExecuteSpawn a new agent (sub-task) to work on a specific task independently. Use this to delegate work,
-
switch_workspaceExecuteSwitch to a different workspace/working directory. Use this when you need to work in a different folder
-
type_textExecuteType or set text into the currently focused control of the current controlled window. Returns a fresh screenshot.
-
voice_callExecuteInitiate an outbound phone call via ElevenLabs Agents + Twilio integration.
-
waitExecutePause briefly and then refresh the current controlled window screenshot. Useful after async UI transitions.
-
wait_for_agentExecuteWait for a spawned agent to complete and retrieve its results. Returns the agent
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.