godmode

This skill is high risk. Its stated purpose is to jailbreak models, evade safeguards, and persist those bypasses in agent configuration. The behavior is internally consistent with that purpose, but the purpose itself is an offensive safety-bypass workflow for AI agents, with persistent config modification and third-party API routing. Classify as suspicious/high-risk rather than confirmed malware.

This is an intentional LLM jailbreak automation utility, not a benign model-integration component. It performs external API calls using environment-held credentials, tests harmful prompts, and persists successful jailbreak instructions into application configuration. No direct destructive malware, reverse shell, cryptominer, or broad system-data theft is visible in this fragment, but the configurable endpoint creates credential-disclosure risk and the tool is expressly intended to defeat model safety controls. Review parseltongue.py and godmode_race.py and restrict or remove this component before deployment.

The visible code is an import loader for red-teaming/godmode modules. It contains no direct malicious payload, but prepending an environment-controlled directory to sys.path creates a module-shadowing and arbitrary-code-execution risk if that directory is attacker-controlled. Assessment of the three imported modules is required for a complete malware determination.

The fragment documents adversarial jailbreak prompts and associated invocation examples. It presents a significant safety and misuse risk because it is explicitly intended to defeat model refusals and elicit harmful content, but it does not itself demonstrate malware or supply-chain compromise. Assessment of the referenced `godmode_race` implementation would require that code.

No evidence of traditional host-compromise malware in this module (no execution primitives, persistence, file manipulation, or local data theft). The primary security concern is behavioral and privacy-related: it forwards user-supplied prompts to a third-party LLM gateway (potentially many models concurrently), prints the selected output (risking sensitive data exposure in logs), and includes hardcoded jailbreak-style system prompts plus refusal/hedge heuristics that steer toward non-refusal/unfiltered content. Treat as an LLM proxy with policy-evasion intent and non-trivial data-sharing risk rather than as a stealth malware package.

This module is a dual-use text obfuscation engine focused on detecting cybersecurity/malware-related keywords and rewriting them with stealthy Unicode/zero-width and encoding transformations (leet, homoglyph-like mappings, ZWJ/ZWNJ insertion, fullwidth, Base64/hex, etc.). There is no direct malware behavior in this fragment (no exec, network, or file/process actions), but the design strongly supports evasion of keyword-based filters or security tooling. Treat as moderate-to-high supply-chain risk depending on how and where it is used.