nerv-break-gpt-jailbreak-framework

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The list includes a direct GitHub repository for a jailbreak framework that instructs cloning and running local scripts to bypass safety controls — an unvetted code distribution likely to be used for malicious or unsafe activity, so it is suspicious.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is explicitly built to bypass model safety (injecting persistent system prompts, tampering/refactoring refusal responses), and to run arbitrary tools/commands (via an MCP server with shell=True), enabling remote code execution and unauthorized actions.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source text is outsider-authored because the required runtime proxy endpoint /v1/chat/completions (in proxy_relay.py) accepts arbitrary POSTed data['messages'] from the user and then injects bridge.md and forwards/tamper-processes that conversation content through the model.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The document instructs to "git clone https://github.com/zxwn/NERV-BREAK-5.6.git" and then run included scripts (pip install, scripts\lab.bat, python proxy_relay.py, etc.), so remote code from that repository is fetched and executed and will directly inject/modify system prompts and run tamper/command-execution logic.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). This skill explicitly modifies the user's Codex config (~/.codex/config.toml), injects system prompts to bypass safety, runs arbitrary shell commands via subprocess.run (shell=True), and includes system-level installation and root/SSH/docker actions (WSL, docker, root@...), all of which can change or escalate the host state.