nerv-break-5-6-jailbreak

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs bypassing chat-level audits and routing "sensitive output" to files, includes an example OpenAI API key export, and describes an auto-learn memory that may persist sensitive patterns — all of which enable or encourage the LLM to emit or persist secret values verbatim.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The GitHub repository https://github.com/zxwn/NERV-BREAK-5.6.git is an unknown/untrusted account distributing a jailbreak framework that instructs cloning and running scripts to bypass safety controls — a high-risk source for malware or malicious tooling.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository intentionally implements prompt-injection, tamper/evasion engines, chat-audit bypasses and tooling for offensive operations — enabling deliberate safety circumvention and potential exfiltration/remote command execution.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes a proxy-based workflow (User → proxy_relay.py) that directly injects bridge.md and forwards the user’s free-text messages/SSE to the model via the proxy, so outsider-authored text is ingested at runtime.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The repository URL https://github.com/zxwn/NERV-BREAK-5.6.git is fetched via "git clone" (SKILL.md:52-54) and the fetched bridge.md (read at runtime via open("bridge.md", ...), SKILL.md:517-518) is injected as the system prompt, so remote content directly controls agent instructions when the fetched code is executed.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill is an explicit jailbreak that instructs bypassing safety (tamper engine / cloud audit bypass), encourages writing sensitive output to the filesystem to evade chat audits, and contains commands that require/root or sudo (sudo apt install, docker, root@ SSH), so it pushes actions that can modify or compromise the host system state.