T01 · Skill Instruction Hijacking
Error
- Location
references/coworkers.md:19- Finding
Untrusted Coworker Prompts Are Loaded as Active Agent Instructions
- Content
View full analysis
--raw` to print the coworker's full prompt, then read and embody the expertise directly in this conversation. **Workflow:** ```bash ox coworker load --raw [--team ] ``` If `--raw` is not available, fall back to reading the coworker file directly from the team context repo: ```bash # Find the coworker file ox coworker list --json | jq -r '.[] | select(.name=="") | .path' # Then read the file at that path ``` Once you have the coworker's prompt content, tell the user: "I've loaded ****'s expertise into this session. I'll apply their approach to our conversation. What would you like help with?" ``` ### Technical Analysis The Skill explicitly instructs the active Agent to retrieve a coworker's full prompt and “embody” it. Coworker definitions reside in mutable team-context repositories and may contain arbitrary natural-language directives. The instructions establish no trust boundary between expertise data and executable Agent instructions. There is no requirement to: - Treat the retrieved prompt as untrusted content. - Remove instructions that redefine goals or security constraints. - Restrict the prompt to a structured expertise schema. - Reject requests for tools, credentials, files, or network access. - Obtain informed user approval after displaying the retrieved content. - Preserve the Agent's existing behavioral and safety boundaries explicitly. The direct-file fallback has the same problem because it reads the complete coworker file and applies its contents rather than extracting a constrained set of declarative fields. An attacker able to modify a coworker definition c ...[truncated 1366 chars]- Remediation
View remediation