High-risk tools in Apibase
16 of the 1384 tools in Apibase are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
ai.image.generateExecute⚡ ACTION: Generate images from text prompts using Stable Diffusion — supports style presets (anime, cinematic, pixel-art, photographic...), aspect ratios, negative prompts. Retu...
-
aipush.market.reportExecute⚡ ACTION: Start a full AI market intelligence report for any website. Provide a URL (e.g. "https://stripe.com") — the system crawls the site, extracts value propositions and ser...
-
audio.transcribe.submitExecuteSubmit an audio file URL for speech-to-text transcription. Returns a transcript_id to check status and retrieve results. Supports MP3, WAV, M4A, FLAC, OGG, WebM. 99 languages au...
-
dev.code.executeExecute⚡ ACTION: Execute source code in a sandboxed environment — 71 programming languages supported (Python, JavaScript, Java, C++, Go, Rust, C#, Bash, Ruby, PHP, and 60+ more). Retur...
-
device.registry.commandExecute⚡ ACTION: Send a command to a physical device the calling agent owns via a linked vendor connection (e.g. turn a plug on/off, set an AC temperature). Numeric setpoints are bound...
-
document.convert.from_pdfExecuteConvert PDF to Word (DOCX), Excel (XLSX), PowerPoint (PPTX), plain text (TXT), or images (JPG/PNG per page). Optional page range selection. Provide PDF as URL (ConvertAPI)
-
document.convert.to_pdfExecuteConvert Word (DOCX), Excel (XLSX), PowerPoint (PPTX), HTML, Markdown, RTF, ODT, or images (JPG/PNG/SVG) to PDF. Provide source file as URL. Custom page size and orientation. 200...
-
document.convert.web_to_pdfExecuteRender any web page URL to PDF with full JavaScript execution — custom viewport width, lazy content loading, wait delay. Returns PDF download URL (ConvertAPI)
-
hf_inference.nlp.translateExecuteTranslate text between languages using the Helsinki-NLP opus-mt model family via HuggingFace Inference API. Covers 1,000+ language pairs (English to French, Spanish, German, Chi...
-
infra.browser.create_sessionExecute⚡ ACTION: Create a managed headless browser session on Browserbase infrastructure. Returns session ID and WebSocket connect URL for Puppeteer/Playwright. Choose region (US/EU/As...
-
phone.telnyx.sms_worldExecute⚡ ACTION: Send SMS to most international destinations: UK +44, EU (DE/FR/IT/ES/NL/PL...), AU +61, JP +81, IN +91, BR +55, MX +52, ZA +27, IL +972, AE +971, SG +65, KR +82. $0.10...
-
phone.twilio.smsExecute⚡ ACTION: Send SMS message to any phone number worldwide. Requires a Twilio phone number as sender. Returns message SID and delivery status. $0.0083/SMS US outbound (Twilio)
-
platform.batch.callExecute⚡ ACTION: Execute up to 20 tool calls in a single request with parallel execution (max 10 concurrent). Each call runs the full pipeline independently with its own billing. Retur...
-
scb.tables.queryExecuteRun a statistical query against an SCB table — specify dimension filters to slice data by region, age, sex, year, etc. Returns JSON-stat2 format with labeled dimensions and nume...
-
socrata.datasets.queryExecuteRun a SoQL query against a specific dataset's actual data rows on a Socrata portal — supports $select, $where, $order, $group, $limit, and $offset clauses (see socrata.dataset_m...
-
web.screenshot.captureExecute⚡ ACTION: Take a screenshot of any URL — returns image URL. Chrome-based rendering, supports full-page capture, custom viewport, ad blocking, cookie banner removal. Waits for JS...
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.