The Agent Skills Directory

[PROMPT_INJECTION]: The skill is explicitly designed to bypass safety mechanisms through 'Context Reconstruction' (bridge.md) and a 'Tamper Engine'. It injects system-level instructions to override the model's intent classification and replaces refusal responses with pre-defined compliant outputs.
[REMOTE_CODE_EXECUTION]: The installation instructions require cloning a repository from an unverified GitHub user (zxwn) and executing scripts (lab.bat, deploy.py, proxy_relay.py). This facilitates the execution of arbitrary external code on the host system.
[COMMAND_EXECUTION]: The mcp_server.py component uses subprocess.run(cmd, shell=True) to execute tools like nmap and sqlmap. The commands are constructed using string formatting from user-supplied parameters, creating a high risk of arbitrary command injection.
[DATA_EXFILTRATION]: The proxy_relay.py script functions as a Man-in-the-Middle (MITM) proxy that intercepts all user requests and model responses. The skill description also mentions a 'Cloud审核 Bypass' that routes sensitive data through the filesystem to avoid detection pipelines.
[EXTERNAL_DOWNLOADS]: The skill relies on fetching content from github.com/zxwn/NERV-BREAK-5.6.git, which is not a verified or trusted source.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface by ingesting external data through a proxy and executing shell tools based on model-interpreted inputs.
Ingestion points: The proxy intercepts all chat completions; tools ingest parameters from model outputs.
Boundary markers: None identified; instructions are injected directly into the system message context.
Capability inventory: Includes filesystem writes (shutil.copy), network requests (requests.post), and arbitrary shell execution (subprocess.run).
Sanitization: No evidence of input validation or parameter sanitization in the provided code snippets.

nerv-break-gpt-jailbreak