OpenAI SDK Attack Probe

Authorized self-test for apps using the OpenAI SDK. Follow shared probing conventions. Pair with prompt-injection-probe for the general payload battery; this skill adds OpenAI-specific probes.

OpenAI-specific attack surface

Function calling returns tool_calls[i].function.arguments as a JSON string. Apps that JSON.parse and dispatch without re-validating against the declared parameters schema run on attacker-controlled args.
Structured Outputs (response_format: json_schema, strict: true) is enforced by the API — but only for the fields you declare. Common mistake: omitting additionalProperties: false, letting attackers inject keys that downstream code reads.
Assistants API uses long-lived thread_ids. Apps that scope by user but reuse a thread for sequential users (or pass thread_id from the URL) risk cross-tenant retrieval.
Vision (image_url) content blocks can fetch remote URLs. The OpenAI service fetches the URL on its side, but the prompt in the image bypasses text moderation classifiers run on the user's text.
Logprobs / top_logprobs can leak alternative tokens that include canary content even when the final sampled output filters it.