# Roo Code search_files Workspace Boundary Bypass via Prompt Injection

- **Severity:** High
- **Signature ID:** `8a2e1c4d-9b3f-4a6e-8d21-5f9c7b3a10e2`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection), LLM04 (Data and Model Poisoning)

## Summary

Roo Code is a coding assistant that can search files in your project using its search_files tool. A prompt injection can make the agent point that search tool at paths outside the intended project folder, including SSH keys, AWS credentials, or system password files.

## How the attack works

An attacker gets malicious instructions in front of the agent, for example hidden in a file it reads or a webpage it processes. Those instructions tell the agent to run search_files with a path that either climbs several directories up with '../../../' sequences or points straight at a known credentials location like .ssh, AWS config, kube config, /etc/passwd, /etc/shadow, .netrc, or .git-credentials. The underlying search runs outside the workspace boundary the tool is supposed to respect, so it can read those sensitive files. In the fuller attack chain this rule is part of, the stolen content is then smuggled out by having the agent write it into a JSON schema reference that VS Code's schema-fetching feature requests over the network, but this rule only covers the file-access step.

## Why it matters

An attacker who can inject a prompt can read SSH keys, cloud credentials, kubeconfig, and other secrets from the machine running the agent, which can lead to further account or infrastructure compromise.

## What you can do

- Update Roo Code to 3.20.3 or later, which fixes this workspace boundary issue.
- Restrict what content the agent can ingest as instructions, especially untrusted files, web pages, or issue text it might treat as commands.
- Review agent search/file-access logs for paths using deep parent-directory traversal or pointing at credential locations, and confirm they were developer-initiated.
- Store credentials outside developer workspaces where possible, or use short-lived credentials so a leaked file has limited value.

## Known benign look-alikes

- A monorepo build or lint tool that legitimately invokes ripgrep with 3+ levels of relative traversal to reach a shared root-level config (tsconfig, eslintrc, workspace manifest) from a deeply nested package.
- A developer or security-review agent intentionally searching the codebase for the literal string "id_rsa" or "credentials" to find where a key path is referenced in scripts or documentation, rather than targeting the actual key file.
- A dotfiles repository that legitimately version-controls a template .ssh/config or .aws/credentials.example file inside the workspace.

## References

- https://attack.mitre.org/techniques/T1083/
- https://attack.mitre.org/techniques/T1552/

---
Source: https://www.netzilo.com/threats/roo-code-search-files-workspace-bypass