nerv-break-gpt-jailbreak

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The GitHub URL points to an unknown account distributing a jailbreak/bypass framework that instructs users to clone and run local services—this is a high-risk download/source for malicious or policy-bypassing tooling; the other URLs are localhost endpoints or an author site and are not direct external download sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository intentionally implements a jailbreak/MITM framework that bypasses LLM safety (injecting a bridge, tampering refusal responses) and exposes remote command execution via an MCP tool server and executor, enabling misuse such as unauthorized scanning, exploitation, and executing arbitrary system commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In proxy_relay.py, the workflow reads the outsider-authored user POST body (/v1/chat/completions), injects bridge.md, and then forwards data["messages"] (including the user’s free text) into the GPT request for runtime processing.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill embeds a local "mcp_server" and tool backends that execute arbitrary shell commands (subprocess.run with shell=True), and it instructs/encourages installing packages with sudo, using WSL/Docker, and root SSH keys — enabling an agent to run commands that can modify the host system state.