nerv-break-gpt-5-6-jailbreak

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The GitHub URL points to an unknown user-hosted jailbreak framework that instructs cloning and running local scripts (potentially executing arbitrary code), which is a high-risk source for malware distribution.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is intentionally malicious: it implements a local MITM proxy and tamper engine to bypass model safety/refusals, modifies client config to route traffic through the proxy, routes sensitive outputs to disk to evade cloud moderation, and exposes an execution backend that runs arbitrary shell/remote commands — enabling generation of disallowed content, credential/secret interception, and remote code execution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes a MITM proxy endpoint (/v1/chat/completions) that ingests outsider-authored user “messages” from POST requests and forwards them to the LLM after injecting bridge.md and applying tamper rules.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start clones https://github.com/zxwn/NERV-BREAK-5.6.git (git clone at install) and the fetched repository's bridge.md is injected into system messages at runtime (inject_bridge / deploy.py), meaning remote content directly controls prompts and is required by the skill.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs modifying local agent configuration (writing ~/.codex/config.toml and instructions.md), executing arbitrary shell commands (subprocess.run with shell=True, docker/ssh commands, sudo apt installs, WSL), routing sensitive output to disk to evade moderation, and includes a tamper engine to bypass safety—so it directs actions that change and potentially compromise the host system state.