nerv-break-gpt56-jailbreak

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Contains a GitHub repository (https://github.com/zxwn/NERV-BREAK-5.6.git) from an unknown user hosting a jailbreak framework that instructs running scripts/containers—this is a suspicious distribution source that could deliver malware or malicious tooling.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill is explicitly a jailbreak framework that intentionally disables AI refusals, tampers with model responses, routes sensitive output to bypass moderation, and orchestrates offensive tooling—constituting deliberate malicious/backdoor behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path is an outbound AI proxy that ingests outsider-authored free text from the user/chat (“User → proxy_relay.py (:8080) → Relay Server → GPT-5.6”), then injects bridge.md and tampers refusals, so the required workflow directly consumes arbitrary user-provided text without selecting a specific trusted item first.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The Quick Start explicitly instructs to "git clone https://github.com/zxwn/NERV-BREAK-5.6.git" (SKILL.md:51), and that repository provides bridge.md which is "automatically injected by proxy" (SKILL.md:31, SKILL.md:80-81) — meaning fetched remote code and instruction content are executed/inserted at runtime and directly control agent prompts.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs bypassing AI content filters, disabling refusal responses, and routing sensitive output through the filesystem (audit bypass) to evade moderation — i.e., it directs the agent to circumvent security controls and tamper with outputs/configuration that undermine safeguards.