High-risk tools in Apple Shortcuts
50 of the 423 tools in Apple Shortcuts are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
apple_shortcuts_runExecuteRun a named Apple Shortcut, optionally with text input. Use this tool to execute any shortcut the user has in their Shortcuts library. Args: - name (string): The exact name ...
-
browser_navigateExecuteNavigate to a URL. Opens the browser if not already running. Only http: and https: URLs are accepted (plus the special about:blank). Other URL schemes (file:, chrome:, chrome-e...
-
browser_waitExecuteWait for an element to appear or for a specified time.
-
character_performanceExecuteAnimate a character with facial expressions and body movements from a reference performance video (Act-Two).
-
ga_batch_run_reportsExecuteRun multiple GA4 reports (max 5) in a single batch request. Each report shares the row-volume safety net of ga_run_report.
-
ga_run_pivot_reportExecuteRun a GA4 pivot report. Pivots are useful for cross-tabulating dimensions (e.g. country x device).
-
ga_run_realtime_reportExecuteRun a GA4 realtime report with configurable dimensions and metrics. Realtime data covers the last 30 minutes by default.
-
ga_run_reportExecuteRun a GA4 report with configurable dimensions, metrics, date range, ordering, and safe dataset controls. Estimates row count first; returns a warning above row_warning_threshold...
-
stop_callExecuteStop an ongoing call immediately. WHEN TO USE: - User wants to end a call in progress - Call is stuck or behaving unexpectedly - Emergency stop COMMON MISTAKES: - Calling this...
-
wait_for_runway_taskExecuteSubmit a task ID and wait for it to complete. Polls automatically.
-
browser_authenticateExecuteOpen a visible browser window so the user can log in manually. The session is saved automatically. WHEN TO USE:
-
browser_backExecuteNavigate back in browser history.
-
browser_forwardExecuteNavigate forward in browser history.
-
browser_hoverExecuteHover over an element (triggers hover menus/tooltips).
-
dub_audioExecuteTranslate and dub audio into a different language, cloning the original speaker\
-
forward_emailExecuteForward an email to other recipients.
-
isolate_voiceExecuteIsolate voice from background audio. Extracts clean speech. Input must be 4.6s-3600s.
-
preview_voiceExecuteGenerate a short audio preview of a voice from a text description, without creating it.
-
reply_to_emailExecuteReply to an email message.
-
salesforce_queryExecuteExecute a raw SOQL query. For advanced queries only — prefer dedicated tools for standard operations. Max 200 records enforced.
-
swap_voiceExecuteReplace the voice in an audio or video file with a different voice, preserving speech content.
-
add_mixmax_sequence_recipientsExecuteAdd recipients to a Mixmax sequence, enrolling them in the automated email drip campaign. IMPORTANT: Confirm with the user before calling — this adds real people to a live sequ...
-
browser_clickExecuteClick an element. Use @ref from browser_snapshot (preferred) or a CSS selector. WORKFLOW: browser_snapshot → find @ref → browser_click @ref
-
browser_closeExecuteClose the browser session. Sessions are saved automatically.
-
browser_fillExecuteClear a field and fill it with text. Use @ref from browser_snapshot. WORKFLOW: browser_snapshot → find input @ref → browser_fill
-
browser_press_keyExecutePress a keyboard key. Common keys: Enter, Tab, Escape, Backspace, ArrowDown, ArrowUp.
-
browser_scrollExecuteScroll the page in a direction.
-
browser_selectExecuteSelect an option from a dropdown.
-
browser_typeExecuteType text character by character (simulates real keystrokes). Useful for search boxes and autocompletes that respond to individual key events.
-
create_custom_voiceExecuteCreate a custom voice from a text description of desired voice characteristics.
-
create_phone_callExecuteCreate an outbound phone call using a Retell AI voice agent. WHEN TO USE: User asks you to make, place, or initiate a phone call. WORKFLOW (typical sequence): 1. list_agents →...
-
create_web_callExecuteCreate a browser-based voice call session. Returns a web_call_link the user can open to talk to a Retell agent. WHEN TO USE: - User wants a voice call in their browser instead ...
-
generate_imageExecuteGenerate one or more images using OpenAI
-
generate_kling_image_to_videoExecuteAnimate a still image into a video using AI.\n\n
-
generate_kling_videoExecuteCreate an AI-generated video from a text description.\n\n
-
generate_musicExecuteGenerate music from a text prompt using ElevenLabs Music API.
-
generate_music_from_planExecuteGenerate music from a composition plan (created by create_music_plan or manually crafted).
-
generate_sound_effectExecuteGenerate sound effects from a text description.
-
generate_speechExecuteGenerate spoken audio from text using ElevenLabs text-to-speech.
-
generate_video_from_imageExecuteAnimate a still image into a video. Supports first-frame (and optionally last-frame) keyframe control.
-
generate_video_from_textExecuteCreate a video entirely from a text description.
-
generate_video_from_videoExecuteRe-style or transform an existing video using Gen-4 Aleph.
-
nano_banana_generateExecuteGenerate images from text descriptions using Google Gemini
-
napkin_generate_visualExecuteGenerate a professional visual (diagram, infographic, illustration) from text using Napkin AI.
-
opus_create_censor_jobExecuteCreate a censor job that processes a specific clip and bleeps / mutes profanity.
-
opus_export_collectionExecuteExport all clips from a collection. Returns a
-
outreach_connect_accountExecuteConnect an Outreach account via OAuth. Takes no parameters — call with {}. Initiates OAuth flow — in standalone mode, opens a browser URL for sign-in. In bridge mode, delegates...
-
publish_agentExecutePublish a specific agent version, making it the active/live version. WHEN TO USE: - After updating an agent
-
replit_setup_sshExecuteSet up SSH keys and configuration for connecting to Replit projects. Generates an Ed25519 key pair, configures ~/.ssh/config, and provides the public key for the user to add to ...
-
salesforce_connect_accountExecuteConnect a Salesforce account via OAuth. Takes no parameters — call with {}. Initiates OAuth flow — in standalone mode, opens a browser URL for Salesforce sign-in. In bridge mod...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.