High-risk tools in ProAgentStore
32 of the 243 tools in ProAgentStore are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
answer_instance_inputExecuteAnswer a needs_input handoff: an agent paused mid-run because it needs a value it must not invent (work authorization, a notice period, an account detail), and is holding the ru...
-
answer_instance_mcp_input_requestExecuteAnswer or cancel a paused outbound MCP call.
-
apply_to_jobExecuteLaunch the LLM-driven job application for a private apply-agent instance: the PAGS agent drives the user
-
approve_instance_taskExecuteApprove a browser runtime task waiting for human approval. Cannot approve a connector call held back by the per-call approval gate — those are approved by a person in the consol...
-
call_instance_toolExecuteInvoke a connector tool (e.g. github_workflow_runs, github_list_issues) on one of your instances. This is a two-step wrapper: first call list_instance_tools with allowed_only:tr...
-
chat_with_agentExecuteSend a message to a published agent (trial mode)
-
chat_with_instanceExecuteChat with your private subscribed instance of an agent. This is the real runtime path with user-owned state and credentials.
-
coding_engine_reauthExecuteSign a coding engine back in from any device when it is blocked on its own login (
-
coding_loop_startExecuteGive an agent an objective and let it work on it autonomously, on the server. Returns a run id immediately — poll status with coding_loop_status and live work events with coding...
-
coding_loop_stopExecuteAsk an autonomous run on an instance to stop. Cooperative: the step in flight finishes and settles its spend. Omit run_id to stop the instance
-
coding_overseerExecuteAsk the cross-repo Overseer agent. It sees all repos, their live sessions, and recent terminal output. Can answer questions and drive Claude Code on specific repos.
-
coding_session_endExecuteEnd a coding session completely. Stops the CLI process/session on the runner.
-
coding_session_freshExecuteEnd the current session and start a brand new one (clean state, no --resume). Fixes corrupted CLI state.
-
coding_session_openExecutePick up work on a repo: opens its conversation and CONTINUES where the last one left off (the engine keeps the previous context for four days), which is what you want for a foll...
-
coding_session_restartExecuteRestart the coding CLI session on the selected runner node. Use when the CLI is stuck or erroring.
-
continue_instance_runExecuteCarry a STOPPED run
-
end_instance_takeoverExecuteEnd a human-takeover session, handing the browser back. This does NOT resume the run — use resume_instance_takeover for that. Ending is the one takeover control whose failure is...
-
execute_agent_builder_planExecuteExecute a reviewed agent-builder plan to create or scaffold a new agent template. This can create durable platform state and, for a scaffold plan, repository material; preview f...
-
force_runner_attachExecuteForce a machine
-
pause_instanceExecuteTemporarily stop one private instance WITHOUT unsubscribing: blocks new runs from starting, and asks any run in flight to stop. Everything is kept — the subscription, config, re...
-
replay_connection_deliveryExecuteRe-arm ONE dead delivery so the pump tries it again — the escape hatch for \
-
resume_instanceExecutePut a PAUSED instance back to work: new runs may start again, and background work (cron, the pump, delivery retries, webhooks) resumes. It does NOT restart runs the pause stoppe...
-
resume_instance_takeoverExecuteResume a run after a human dealt with what it handed off — a captcha solved, a widget operated, a page signed into. The agent re-checks the page and carries on. Answering a need...
-
run_instance_taskExecuteCreate a task on the registered local or managed browser runtime for a private instance. The PAGS brain stays in control; the local ProAgentStore runner executes browser capabil...
-
run_instance_triggerExecuteManually run one configured instance trigger now. This can create tasks, add knowledge, or sync a granted connector folder.
-
send_instance_takeover_inputExecuteSend ONE mouse or keyboard event into a taken-over page (relayed to the real browser over CDP). This is the raw remote-control primitive the console
-
set_instance_runner_nodeExecutePin one instance to a specific machine, so its runner calls (chat tools, apply, coding) route there — and MOVE it there in the same call: when that machine\
-
start_instance_browser_taskExecuteStart a browser task on a private instance: the agent drives the owner
-
start_instance_loopExecuteGive an agent an objective and let it work autonomously on the server. Durable: it survives you closing the browser, and its spend is bounded by a budget. Returns a run id — pol...
-
stop_instance_loopExecuteAsk an autonomous run to stop. Cooperative: the step in flight finishes and settles its spend rather than being killed mid-way. No dry run — call check_instance_loop first to se...
-
test_instance_mcp_serverExecuteConnect to a remote MCP endpoint as this instance would and report what is actually true about it: whether it answered, what tools it publishes, and for each tool whether this a...
-
trigger_agent_deployExecuteTrigger the GitHub Actions deploy workflow for an owned agent repo.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.