Purpose
CoWorker Protocol addresses the problem of "sharing a skill equals leaking it." The traditional approach is to write the methodology as plain-text SKILL.md and share it; anyone who can open the file can see all of its contents, copying the file is equivalent to taking away the author's methodology, and there is no access control and no revocation mechanism. CoWorker's positioning is to turn SKILL.md into a secure API: the skill always runs on the author's own machine, and the caller only gets the result after a remote call; the code, prompts, and methodology are never transmitted. The project describes its stance as "anti-distillation is a band-aid; Skill-as-API is the fundamental solution."
Main capabilities
- Skill-as-API: Encapsulate a skill as a remotely callable interface; the caller obtains the function return value rather than the raw LLM output.
- P2P collaboration: Peer-to-peer communication based on the XMTP network, without relying on a centralized API call model.
- End-to-end encryption: Messages are transmitted over the XMTP network, and the project states that XMTP Production E2E encryption is used throughout.
- Revocable trust: Supports revocation of trust relationships.
- Asynchronous delegation: Similar to sending a message rather than a synchronous API call; when the other party is offline, the message queues on the XMTP network and is automatically processed once the other party comes online.
- Zero dependencies: The project describes itself as having zero dependencies.
- Security boundary: The caller calls a function interface rather than the author's LLM, and the protocol transmits the function return value rather than the raw LLM output; therefore, even if malicious instructions are embedded in the input, what is obtained is only the function's return value, and the attack surface shrinks from the LLM layer to the function layer.
How to use
The project provides a single command to turn SKILL.md into a secure API (the specific command content is not given in the materials). The caller needs to connect to a resident Bot named icy, and the project says no invitation code is required. Sharing is done by sending a credential containing only a routing ID and no key, which can be passed through channels such as WeChat, Feishu, and GitHub, and can be reused.
Applicable scenarios
- Wanting to share an analysis methodology accumulated by an individual or team with colleagues or external collaborators in a "usable but non-copyable" way.
- Needing to expose skill capabilities in an untrusted caller environment while avoiding prompt and code leakage.
- Needing asynchronous, offline-capable delegation and collaboration between agents.
Limitations and notes
- The test result described by the projectis 5/5 skill calls passed, with hot-connection latency of 1.8–2.9 seconds; this data comes from the project side's description, and no independent verification information is provided.
- The materials mention that the current Skill ecosystem has 700,000+ Skills, with 26% carrying security risks, but the source and definition of this statistic are not given.
- Specific installation commands, API details, supported models or platforms, and charging and pricing information are not yet provided in the materials.
- The project is licensed under MIT, the authors are Ziwei Zhao, Dantong Liu, and Xizhi Ding, and the advisor is Wenxuan Wang of Renmin University of China.
