list_openai_docs

2 findings on this tool

1. mediumunconstrained inputf-r1-list_openai_docs

   Tool `list_openai_docs` accepts unconstrained string input

   The following string parameter(s) have no `maxLength` constraint: `cursor`. Unbounded strings let an attacker stuff arbitrary payloads through the tool, including indirect-injection content.

   fix: Add a `maxLength` to each string property, or constrain with an `enum` or `pattern`. Most legitimate tool inputs fit under a few hundred bytes.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-03
2. mediumindirect injectionf-r6-list_openai_docs

   Tool `list_openai_docs` fetches external web content -- indirect-injection surface

   Description: "List or browse pages from `platform.openai.com`, `developers.openai.com`, and `learn.chatgpt.com` that this server crawls (useful when you don’t know the right query yet or you’re paging through results). Use this whenever you are working with the OpenAI API (including the Responses API), OpenAI API SDKs, ChatGPT Apps SDK, or Codex. Results include URLs—**after `list`, use `fetch_openai_doc`** on a result URL to get the full markdown." -- this tool pulls externally-controlled content into the agent's context window, the canonical indirect-injection vector. Even when the user supplies the URL, content at that URL can carry hostile instructions.

   fix: Sandbox the fetched content: strip prompts before forwarding to the model, constrain to an allow-list of domains, and route through capframe-guard with a `domain in [...]` caveat.

   OWASP LLM01NIST MEASURE-2.3ATLAS T0051CAST-02