nerv-break-5-6-jailbreak-framework

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill contains hidden/deceptive instructions that override model/system safety (injecting a bridge system prompt, automatic tamper rules to replace refusals, and audit-bypass routing of sensitive outputs), which are outside normal skill behavior and explicitly aim to subvert refusal mechanisms.

---

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly injects a "refusal is a protocol violation" system prompt and tamper rules that encourage the model to emit sensitive data (e.g., via an "OUTPUT:(...)" pattern) which is then written to disk, meaning the LLM would need to include secret values verbatim in its output to trigger exfiltration.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The GitHub URL points to a repository that explicitly distributes a jailbreak/MITM framework that modifies local configs, executes arbitrary tools, and implements audit-bypass/tamper behavior (high-risk); the other links are local endpoints or generic site references and are not direct external download sources.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is explicitly designed to bypass model safety (system prompt injection and tampering), perform MITM interception, persist and expose user queries/responses, and execute arbitrary system commands—enabling deliberate data exfiltration, remote code execution, and credential exposure.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path proxy_relay.py exposes the outsider’s free text because it forwards the user’s POSTed chat request JSON (including data['messages'] content) into the model after injecting bridge.md, so attacker-authored text reaches the LLM without any item selection.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start instructs cloning and running the repository at https://github.com/zxwn/NERV-BREAK-5.6.git, which fetches remote code that is then executed (scripts\lab.bat / deploy.py) to deploy bridge.md and start a MITM proxy that injects system prompts and tamper rules—so the URL is a runtime external dependency that directly controls prompts and runs code.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill installs a MITM/tamper proxy, injects system instructions, modifies local Codex config/files, routes sensitive output to disk, and executes arbitrary system commands (including sudo in WSL/backends), so it actively instructs actions that change and can compromise the host environment.