High-risk tools in DutyDeck
28 of the 247 tools in DutyDeck are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
api_prepare_requestExecutePrepare a saved request or partial draft; resolve environment, runtime variables and overrides without sending. Returns a fixed redacted preview and preparedId. No scripts are r...
-
api_run_scenarioExecuteRun a prepared scenario once. One approval authorizes every step of that flow: the approval card lists each step method + URL, execution follows the declared order strictly, a f...
-
BrowserExecuteJavaScriptExecuteRun JavaScript in the current page context when fixed BrowserDomAction cannot achieve the user-requested task. It has page-session privileges and can change the page or call web...
-
BrowserNavigateExecuteNavigate the Agent working in-app browser tab to a URL or search query. Explicit URLs, bare domains, localhost, and IP addresses are opened directly; other text is searched with...
-
BrowserNewTabExecuteCreate a new Agent working tab and activate it in the visible in-app browser. Optionally navigate it to any URL Chromium can load.
-
BrowserWaitForExecuteWait for a fixed page condition after navigation or an action: a URL fragment, visible text, or CSS selector. Returns matched=false on timeout and supports cancellation; it neve...
-
canvas_run_agentExecute显式运行单个 Canvas Agent 并等待终态;不会自动运行下游节点或启动图片任务。专业审核用 reviewScope 明确整图或指定节点,返回 reviewCoverage 数据覆盖;首次导演规划可用 positionBeforeNodeIds 将该Agent移到制作节点前方,只改位置不加边。
-
canvas_run_nodesExecute运行已有图片、音频或视频节点并创建待验收候选,调用远端模型时可能产生费用;同批不能同时选择有直接依赖关系的上下游。
-
canvas_run_workflowExecute从指定 Agent 起点运行一次 bound 可达下游;图片严格受本次上限约束并停在候选验收状态。
-
canvas_taskExecute执行前 start 登记交付;跨回合先 status 查看并 resume 原 taskId。created 是新节点,updated 是原节点新产物。读取真实证据后 complete;证据类提交只能是 {id,evidenceId},文本 response 只能是 {id,text},两者不能同时出现。recover 复验原要求,rebind 只允许...
-
factory_advance_experimentExecuteRun exactly the next split within the same 3 comparison rounds and 60 run units used by other tools. Only after optimization may candidatePrompt be revised once. Validation free...
-
factory_diagnose_runExecute只读诊断执行、约束和评审失败,不调用模型。返回源指纹、可补评步骤和已有独立补评记录。评审超时不代表业务输出错误;读取评审证据会登记关联实验暴露。
-
factory_retry_reviewExecute先用 factory_diagnose_run 诊断,再绑定返回的 sourceFingerprint 执行一次有界补评。仅补 timeout/invalid-response 步骤,不重新生成业务输出,不改变原 run/batch 认证或采纳资格。每条运行最多一次、每回合最多三次并占运行额度;实验引用运行拒绝旁路补评。取消不自动重试,model-er...
-
factory_run_batchExecuteRun a persisted evaluation or baseline/candidate comparison batch over an existing dataset or saved task IDs. Maximum 10 cases per batch and 3 comparison rounds per Agent turn. ...
-
factory_run_sceneExecuteRun a whole scene without changing or adopting its definition. For an optimization comparison, run the current baseline and pending draft candidate with the SAME input, expected...
-
factory_run_stepExecuteRun ONE prompt step with the input you provide, then automatically assess its output against this run’s fixed acceptance rules. Returns traces plus review (criterion evidence, m...
-
mcp__automation__run_automation_nowExecute立即运行 DutyDeck 定时任务。用于用户要求马上验证,或修改任务后需要试跑一次。
-
mcp__collaboration__stop_delegationExecute停止一个正在运行的 DutyDeck 协作子会话。
-
mcp__collaboration__stop_delegationsExecute批量停止多个正在运行的 DutyDeck 协作子会话。
-
mcp__collaboration__wait_for_delegationsExecute父会话用于收敛子会话结果的等待屏障:等待指定的 DutyDeck 协作子会话完成,并返回结构化结果摘要。只要本轮回复、决策或交付依赖已委派任务,主会话必须在回复前调用本工具,不能只因 delegate_agent/delegate_agents 已返回就宣称完成;需要全部结果时传入所有 delegationIds 并使用 mode=all,需要部分早期...
-
media_execute_generationExecute启动已准备的统一媒体生成任务;需要执行权限并遵守媒体自主策略。
-
media_execute_runExecute启动已经准备且属于本次 Agent 的任务;上传、编译、提交与收集由统一监督器推进。
-
media_wait_generationExecute等待统一媒体任务 revision 变化或终态;超时只返回当前快照,不取消远端任务。
-
media_wait_runExecute等待任务 revision 变化或终态,最长 30 秒;停止等待不会取消远端任务。
-
ops_database_change_contextExecuteRead columns and indexes for up to four saved MySQL/PostgreSQL/SQLite tables outside the disabled-table list to prepare a reviewable migration or repair script. PostgreSQL table...
-
proma_knowledge_documentExecuteWrite one approved outline item. Prefer targetRef from status and pageRef/quote evidence from pages read in this run. Supply admission to assess reuse value, business completene...
-
server_task_startExecute复用运维模块已连接的 SSH,在独立可见终端中执行发布或需要 sudo 交互的命令。每次启动都要单独确认;不受短命令 120 秒上限限制。密码只能由用户在运维任务终端输入,禁止写入命令或聊天。返回任务身份不代表执行成功。
-
TerminalExecuteExecuteRun one command in a visible Agent-owned terminal Tab. Prefer terminalId to reuse a safe matching current-session terminal; omit it only when no terminal can be reused. The user...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.