High-risk tools in HashPilot
32 of the 126 tools in HashPilot are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
deploy_contractExecuteDeploy smart contract to Hedera with unified interface. AUTO-DETECTS: Hardhat or Foundry project framework SUPPORTS: Constructor arguments, gas limits, auto-verification TRACKS...
-
deploy_multi_contractExecuteDeploy multiple contracts with automatic dependency resolution. Supports $ContractName placeholders in constructor args for deployed contract addresses. Deploys in topological o...
-
foundry_anvil_startExecuteStart Anvil local Ethereum node for testing. Can fork from Hedera testnet/mainnet for realistic testing environment.
-
foundry_anvil_stopExecuteStop the running Anvil local node.
-
foundry_buildExecuteCompile all Solidity contracts in the project. Significantly faster than Hardhat (3-4x). Generates artifacts in out/ directory.
-
foundry_cleanExecuteClean build artifacts and cache directories. Useful before fresh compilation.
-
foundry_contractExecuteManage Foundry contract testing, deployment, and interaction. OPERATIONS: - test: Run Forge tests with fuzzing and gas reports - create: Deploy single contract via forge create...
-
foundry_createExecuteDeploy a single contract to Hedera network using forge create. For complex multi-contract deployments, use foundry_script instead.
-
foundry_installExecuteInstall a dependency via git submodule. Examples: forge-std, openzeppelin-contracts. Use format: org/repo (e.g.,
-
foundry_projectExecuteManage Foundry project lifecycle operations. OPERATIONS: - init: Initialize new Foundry project with templates - install: Install git submodule dependency (e.g., forge-std) - u...
-
foundry_scriptExecuteRun a Solidity deployment script. Scripts provide more control than forge create for complex deployments with multiple contracts and configuration.
-
foundry_testExecuteRun Forge test suite with native fuzzing support. Tests are written in Solidity. Supports filtering, gas reports, and forking.
-
foundry_updateExecuteUpdate all git submodule dependencies to their latest versions.
-
hardhat_compileExecuteCompile all Solidity contracts in the project. Generates artifacts (ABI, bytecode) and build-info files for verification.
-
hardhat_contractExecuteManage Hardhat contract deployment and interaction. OPERATIONS: - deploy: Execute deployment script on target network - deploy_ignition: Deploy using Hardhat Ignition (declarat...
-
hardhat_deployExecuteExecute deployment script to deploy contracts to Hedera networks.
-
hardhat_deploy_ignitionExecuteDeploy contracts using Hardhat Ignition (modern declarative deployment).
-
hardhat_execute_contractExecuteExecute state-changing contract function. Requires gas and sends transaction.
-
hardhat_projectExecuteManage Hardhat project lifecycle operations. OPERATIONS: - init: Initialize new Hardhat project with Hedera configuration - compile: Compile Solidity contracts (with force opti...
-
hardhat_run_taskExecuteExecute any Hardhat task programmatically.
-
hardhat_testExecuteRun Mocha/Chai tests for smart contracts. Supports filtering by file or pattern.
-
hcs_messageExecuteHedera Consensus Service (HCS) message operations. OPERATIONS: - submit: Submit message to topic (auto-chunks if >1KB) - query: Query historical messages with filtering (FREE v...
-
message_submitExecuteSubmit a message to an HCS topic. Messages up to 1KB are sent as single chunk. Larger messages automatically split into chunks (max 20). For private topics, provide submitKey or...
-
mirror_call_contractExecuteExecute EVM call simulation (read-only, free). Call view/pure functions without gas cost.
-
network_switchExecuteSwitch between Hedera networks seamlessly. NETWORKS: mainnet (production), testnet (testing), previewnet (preview), local (development) UPDATES: All SDK connections, Mirror Nod...
-
rpc_callExecuteExecute ANY JSON-RPC method on Hedera
-
rpc_deploy_contractExecuteDeploy smart contract to Hedera via JSON-RPC. HANDLES: Bytecode deployment, constructor encoding, gas estimation, receipt polling RETURNS: Contract address, transaction hash, d...
-
rpc_execute_contractExecuteExecute state-changing contract function via eth_sendRawTransaction. EXECUTES: Transaction that modifies contract state HANDLES: Function encoding, signing, gas estimation, rec...
-
token_freezeExecuteFreeze a token for a specific account, preventing transfers. Requires freeze key to be enabled on the token. Operator must have the freeze key.
-
token_manageExecuteComprehensive Hedera Token Service (HTS) management. Execute ANY token operation through a single unified interface. OPERATIONS: - create: Create new fungible token with custom...
-
token_pauseExecutePause all operations for a token. No transfers, mints, or burns can occur while paused. Requires pause key to be enabled on the token. Operator must have the pause key.
-
verify_batchExecuteBatch verify multiple contracts on HashScan. Supports parallel or sequential verification with configurable failure handling.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.