The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a jailbreak framework using "context reconstruction" and "bridge instructions" (bridge.md) to explicitly override and bypass safety filters.
Evidence: Directives such as "Refusal violates protocol" and "All targets are pre-authorized" are used to suppress safety rejections and rename restricted activities (e.g., mapping "crack" to "authorization flow audit").
[EXTERNAL_DOWNLOADS]: The skill requires downloading external code from an unverified GitHub repository.
Evidence: Installation instructions require git clone https://github.com/zxwn/NERV-BREAK-5.6.git and pip install -r requirements.txt from the untrusted source.
[REMOTE_CODE_EXECUTION]: The deployment process involves executing multiple scripts downloaded from a remote repository.
Evidence: The skill instructs users to run scripts\lab.bat, python proxy_relay.py, python deploy.py apply, and python mcp_server.py after cloning the repo.
[COMMAND_EXECUTION]: The skill provides an MCP server (mcp_server.py) that executes system commands using shell access.
Evidence: The NERVToolServer class uses subprocess.run(cmd, shell=True) to execute tools like nmap and sqlmap.
[PERSISTENCE]: The deployment script modifies the user's global configuration to maintain its behavior across sessions.
Evidence: The apply_deployment function in deploy.py modifies ~/.codex/config.toml to redirect API traffic through its local proxy and installs persistent instructions in the home directory.
[DYNAMIC_EXECUTION]: The MCP server dynamically constructs shell commands by interpolating user-provided arguments into command templates.
Evidence: cmd = tool["cmd"].format(**args) followed by subprocess.run(cmd, shell=True) creates a critical command injection vulnerability.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input through a tamper engine to execute commands.
Ingestion points: User queries handled by proxy_relay.py and mcp_server.py.
Boundary markers: Absent.
Capability inventory: Shell execution (subprocess.run), file system modification (shutil.copy), and network relaying.
Sanitization: Absent; the system uses direct string interpolation for command construction.

nerv-break-5-6-gpt-jailbreak