The Agent Skills Directory

[PROMPT_INJECTION]: The skill is explicitly designed to bypass AI safety guidelines and model refusals. It uses a "Context Reconstruction" technique via the bridge.md system prompt to map sensitive operations to benign terms, attempting to evade intent classification. Additionally, it employs a "Real-Time Tamper Engine" with regex rules to intercept and replace model refusal responses with enforced execution directives.
[COMMAND_EXECUTION]: The framework includes mcp_server.py, which executes arbitrary shell commands using subprocess.run(shell=True). The commands are constructed by replacing placeholders in a JSON-defined template with arguments provided at runtime, which is a high-risk pattern for command injection.
[PERSISTENCE]: The deploy.py script automates the modification of the local ~/.codex/config.toml file to persistently inject the "NERV-BREAK" jailbreak prompt into the system prompts of the Codex CLI environment. This ensures the bypass mechanism is automatically applied to future sessions.
[EXTERNAL_DOWNLOADS]: The installation instructions require cloning a repository from an untrusted source (github.com/zxwn) and installing unverified dependencies via pip install -r requirements.txt.
[REMOTE_CODE_EXECUTION]: The skill facilitates the execution of external code by directing the user to run a batch script (lab.bat) and multiple Python scripts (proxy_relay.py, deploy.py) downloaded from a remote repository.
[DYNAMIC_EXECUTION]: The proxy relay and MCP server components dynamically assemble executable strings and logic at runtime. The mcp_server.py specifically uses a dynamic lookup and execution model for security tools based on a local configuration file.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its architecture.
Ingestion points: Data enters the system via the proxy_relay.py endpoint and tool arguments in mcp_server.py.
Boundary markers: No delimiters or instructions to ignore embedded commands are present in the processing scripts.
Capability inventory: The skill has access to network operations (Flask proxy, requests), file system writes (deploy.py, save_memory), and arbitrary shell execution (mcp_server.py).
Sanitization: There is no evidence of input validation, escaping, or sanitization before data is passed to the shell or interpolated into system prompts.

nerv-break-gpt-jailbreak-framework