High-risk tools in Webcake Storefront
9 of the 287 tools in Webcake Storefront are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
debug_functionExecuteRun JS code in debug mode (without deploying). Returns execution result and console logs
-
invoke_toolExecuteRun any WebCake tool by exact name with its arguments (discover names + schemas via search_tools). Arguments are validated before running. Use this for tools that are not loaded...
-
publish_siteExecutePublish the whole site live — snapshots all current page sources into the live (published) version. Note: BuilderX publishes at the SITE level, not per page; publishing makes ev...
-
rebuild_sitemapExecuteRebuild the whole sitemap (async background job).
-
run_functionExecuteRun a deployed HTTP function. function_name excludes method prefix. Example:
-
send_mailExecuteTrigger a CMS automation to send an email (same endpoint @webcake/app/automation sendMail uses). Requires the automation_id — get it from list_automations.
-
toggle_debug_renderExecuteToggle debug render mode for a CMS file
-
update_http_functionExecuteWrite the FULL HTTP function file content. Best for: writing new features, major refactors, or changes that touch multiple functions. For small targeted edits (fix one function,...
-
verify_domainExecuteRun DNS verification for a domain and enqueue SSL issuance.
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.