High-risk tools in ScreenHand
50 of the 89 tools in ScreenHand are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
applescriptExecuteRun an AppleScript command. For controlling Finder, Safari, Mail, Notes, etc. (macOS only). WARNING: Executes arbitrary AppleScript — can perform destructive actions (delete fil...
-
app_launchExecuteLaunch a macOS/Windows application by bundle ID (e.g.,
-
browser_jsExecuteExecute JavaScript in a Chrome/Electron tab. Returns the result. WARNING: This runs arbitrary JS in the browser context — avoid on sensitive pages (banking, email). All executio...
-
browser_navigateExecuteNavigate the active Chrome/Electron tab to a URL
-
browser_waitExecuteWait for a condition on a Chrome/Electron page
-
launchExecuteLaunch an application by bundle ID
-
navigateExecuteNavigate a browser to a URL, or open an app via
-
observer_startExecuteStart the observer daemon to continuously watch an app window. Captures frames via CGWindowListCreateImage, runs OCR only when pixels change, detects popups. Zero overhead on en...
-
observer_stopExecuteStop the observer daemon.
-
orchestrator_startExecuteStart the multi-agent orchestrator daemon. Manages parallel worker slots: web tasks (CDP) run in parallel, native tasks (AX/keyboard) are serialized per-app. Survives restarts.
-
orchestrator_stopExecuteStop the orchestrator daemon. Running tasks finish before exit.
-
playbook_recordExecuteMacro recorder: start/stop/trim/clean recorded playbooks. Use
-
playbook_runExecuteExecute a saved playbook by ID or auto-match by task description. Playbooks run deterministically without AI calls. If a step fails, AI automatically recovers and patches the pl...
-
recording_startExecuteStart recording user actions to auto-generate a playbook. Do the task manually while recording, then call recording_stop to save.
-
recording_stopExecuteStop recording and save the captured actions as a new playbook.
-
session_startExecuteStart a new automation session. Returns a sessionId needed by all other tools. Automatically attaches to the frontmost app.
-
task_runExecuteRun a complete task autonomously. Starts an observe→decide→act loop that uses the accessibility tree (not screenshots) to see the UI and Claude to decide each action. The loop c...
-
wait_forExecuteWait for a condition: element appears/disappears, text appears, URL changes, window title matches, etc.
-
wait_for_stateExecuteWait until a condition is met on screen: text appears, text disappears, or element becomes available. Polls at intervals using the fallback chain.
-
app_focusExecuteBring a running application to the foreground.
-
browser_stealthExecuteInject anti-detection patches into Chrome/Electron page. Call once after navigating to a protected site. Hides webdriver flag, patches plugins/languages/permissions.
-
flickExecuteFast swipe/flick gesture (for iOS home gesture etc)
-
focusExecuteFocus/activate an application by bundle ID
-
keyExecutePress a key combination
-
platform_exploreExecuteAutonomously explore an app or website. Maps all interactive elements, tries each one, records working selectors and broken paths. Outputs a reference JSON.
-
watch_dialogExecuteRegister a dialog watch rule: when a dialog matching the pattern appears, auto-execute an action.
-
watch_registerExecuteRegister a watch rule: when element with matching title appears, execute an action. Use for automated responses to known UI states.
-
watch_startExecuteStart the state watcher polling loop. Evaluates registered watch rules every 2s against the world model.
-
watch_stopExecuteStop the state watcher polling loop.
-
ax_pressExecuteFind a UI element by title and press/click it via accessibility
-
browser_clickExecuteClick an element in Chrome/Electron by CSS selector. Uses CDP Input.dispatchMouseEvent for realistic mouse events.
-
browser_fill_formExecuteFill a form field with human-like typing (anti-detection). Uses real keyboard events via CDP Input domain.
-
browser_human_clickExecuteAlias for browser_click — both use realistic mouseMoved → mousePressed → mouseReleased events. Prefer browser_click directly.
-
browser_openExecuteOpen a URL in Chrome/Electron (creates new tab)
-
browser_typeExecuteType into an input field in Chrome/Electron. Uses CDP Input.dispatchKeyEvent for real keyboard events (works with React/Angular).
-
clickExecuteClick at screen coordinates
-
click_textExecuteFind text on a window via OCR and click it. Handles Retina + shadow coordinate mapping.
-
click_with_fallbackExecuteClick a target by text using the canonical fallback chain: AX → CDP → OCR. Automatically retries and falls through methods.
-
dragExecuteDrag from one point to another (slow, smooth)
-
key_comboExecuteSend a keyboard shortcut. Keys:
-
menu_clickExecuteClick a menu item in an app
-
orchestrator_submitExecuteSubmit a task to the orchestrator. Web tasks (CDP) run in parallel, native tasks queue per-app. Returns immediately — task is processed asynchronously.
-
pressExecuteClick/press a UI element. Finds the element by text, role, selector, or coordinates, then clicks it.
-
scrollExecuteScroll at a position
-
scroll_with_fallbackExecuteScroll within an element or the active window using the canonical fallback chain: AX → CDP → coordinates. Scrolls until target text is visible, or by a fixed amount.
-
select_with_fallbackExecuteSelect an option from a dropdown/menu using the canonical fallback chain: AX → CDP. Finds the control, opens it, and picks the specified option.
-
type_intoExecuteType text into a UI element (text field, search box, etc). Locates the field, optionally clears it, then types.
-
type_textExecuteType text using keyboard
-
type_with_fallbackExecuteType text into a target field using the canonical fallback chain: AX → CDP → coordinates. Finds the field by label/placeholder, focuses it, then types.
-
ui_pressExecutePREFERRED: Find and press/click a UI element by its title via Accessibility. Faster and more reliable than click_text — no screenshot needed.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.