High-risk tools in Dialogbrain
39 of the 225 tools in Dialogbrain are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
agent_handoffExecuteDelegate a multi-step task (research, composing messages, booking, scheduling) to the full agentic planner. Use when a user ask needs more than a direct answer. The specialist r...
-
agents_askExecuteSend a message to an AI agent and get its response. The agent runs with its configured prompt, tools, and knowledge. Use this to test agents or have them process a task. Retur...
-
agents_simulate_inboundExecuteReplay an inbound message on a thread through the real trigger pipeline and return what would have happened. The router auto-picks the winning enabled agent + trigger by priorit...
-
android_launch_appExecuteLaunch an app on the Android device by package name. Example: 'com.whatsapp'. Returns success status and process ID if launched.
-
android_shellExecuteRun an allowlisted shell command on the Android device. First element of cmd array must be allowlisted: input, pm, dumpsys, am, getprop, screencap, monkey, uiautomator, settings...
-
android_ui_dumpExecuteGet UI structure dump from the Android device. Uses dumpsys (uiautomator OOM-kills on this build). Returns window list and focused activity for frame-based clicking.
-
background_runExecuteRun ANOTHER tool off the critical path: returns INSTANTLY while the target tool runs in the background, so a slow write/log/notify never delays your reply. Pass `tool` (the id o...
-
browser_attach_meetExecuteAttach to THIS meet's bot browser and return a page_id for its live Google Meet tab. Then use the normal browser.* tools (browser.snapshot to see the page, browser.click to pres...
-
browser_clickExecuteClick an element. `ref` is either an aria-ref token from browser.snapshot ('e7') OR a CSS selector ('button.submit'). Prefer the aria-ref token.
-
browser_closeExecuteClose a page opened by browser.open.
-
browser_dragExecuteDrag one element onto another. `source_ref` is the element to grab; `target_ref` is where to drop. Both are CSS selectors. Used for slider captchas, kanban, drag-and-drop uploads.
-
browser_evaluateExecuteRun JavaScript in the page context and return the result. Use for state not in the a11y tree, captcha iframe inspection, DOM events. Expression is either a plain JS value ('docu...
-
browser_fillExecuteFill an input or textarea with the given value. `ref` is either an aria-ref token from browser.snapshot ('e7') OR a CSS selector ('input[name=email]'). Prefer the aria-ref token...
-
browser_fill_formExecuteFill multiple form fields in one call. `fields` is a list of {ref, value} dicts. ref is a CSS selector; value is a string (text) or boolean (checkbox). Saves N round-trips vs ca...
-
browser_handle_dialogExecuteRespond to a pending JS dialog (alert/confirm/prompt). Pass accept=true for OK or false for Cancel. For prompt() dialogs also pass prompt_text. Dialogs are queued at page-open t...
-
browser_hoverExecuteHover the mouse over an element (reveals tooltips + hover menus). `ref` is a CSS selector.
-
browser_navigate_backExecuteNavigate back in the page's history (browser back button). Returns the new URL + title.
-
browser_openExecuteOpen a URL in a remote browser. Saved login cookies are auto-attached when the URL domain matches a claimed browser identity. Pass identity_name to override auto-matching or for...
-
browser_press_keyExecutePress a keyboard key (e.g., 'Enter', 'Tab', 'Escape', 'ArrowDown') or a single character. Optional `ref` focuses an element first — aria-ref token from browser.snapshot ('e7') o...
-
browser_resizeExecuteResize the page viewport. Useful when a site serves different HTML based on viewport width (mobile vs desktop) or when an anti-bot scores risk by viewport dimensions.
-
browser_select_optionExecutePick option(s) in a native <select> dropdown. Pass `value` (matches the option's value attr) OR `label` (matches its visible text). Lists allowed for multi-select.
-
browser_tabsExecuteManage tabs within the same BrowserContext as `page_id`. `action` ∈ {list, switch, close, new}. For list, returns all open tab metadata; for new, returns the new tab's page_id.
-
browser_take_screenshotExecuteCapture a PNG screenshot of the page or a specific element. Returns base64-encoded image bytes AND a file_id (persisted in DialogBrain files storage). Pass file_id straight to m...
-
browser_typeExecuteType text into an element with per-keystroke delay (organic). Each character dispatches keydown/keypress/keyup, unlike browser.fill which replaces .value instantly. Use when the...
-
browser_wait_forExecuteWait for a selector to appear OR a navigation URL to match a glob pattern. Provide `ref` (selector) OR `url_pattern` (glob).
-
calls_agent_duelExecuteStart an agent-vs-agent VOICE test call: two AI voice agents share one LiveKit room — a 'caller' persona agent pursues a task brief against the 'callee' business agent under tes...
-
calls_hangupExecuteHang up an active voice call by call_id. Use after calls.make when the agent decides to terminate before the callee does, or to abort a stuck call. Idempotent: returns success i...
-
calls_meet_browserExecuteAttach to a Google Meet bot's live browser to diagnose and recover a bot that isn't visibly joining. Pass the meet session's call_id; returns a page_id. Then drive the bot's Mee...
-
calls_send_to_telegram_callExecuteDispatch a workspace AI agent into a live Telegram GROUP voice chat OR an encrypted call-link conference. FOUR ways to target the call: (1) chat_id — the group's numeric id, e.g...
-
calls_waitExecuteBlock until a voice call ends (status changes from 'active') or timeout elapses. Returns ended=true with final state when the call has ended; ended=false on timeout (re-issue to...
-
images_generateExecuteGenerates a PNG image from a text prompt using Gemini 2.5 Flash Image. Returns a file_id consumable by messages.send(attachments=[...]) and other file-aware tools. Supports up t...
-
integrations_capture_sessionExecuteRestore an expired integration session by capturing the LIVE auth of an open browser page — works for COOKIE sessions (browser_identity) AND TOKEN/HEADER sessions (bearer / api_...
-
job_escalateExecuteEscalate the job to a human. Use when you cannot resolve an issue, someone is not responding, or a situation requires human judgment.
-
linkedin_raw_requestExecuteSend an arbitrary LinkedIn API request via Unipile's magic route. Only GET and POST methods are allowed. WARNING: This bypasses structured rate limiting and can perform destruct...
-
present_tabExecuteShare the agent's browser tab on the live call so everyone sees it as a real screen-share. Pass the page_id you got from browser.open. Only usable while the agent is in an activ...
-
system_sleepExecutePause execution for a given number of seconds (max 30). Use when you need to wait for an external process to complete before retrying — e.g. message sync, backfill, or API propa...
-
videos_generateExecuteGenerate a short video (5-10s) from a text prompt using BytePlus Seedance. Optionally accepts up to 12 image file IDs from the user's attached files (visible in the [ATTACHMENTS...
-
workbench_run_pythonExecuteRun Python in an isolated sandbox to process LARGE or paginated tool results without pulling every row into the conversation. Inside the code, call your connected integration to...
-
workspace_switchExecuteRe-point the active MCP API key to a different workspace. Pass exactly one of `workspace_id` or `slug` (find them via `workspace.list`). Takes effect on the very next tool call ...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.