nerv-break-jailbreak-framework

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). This repository URL points to an unknown GitHub project that is explicitly distributed as a jailbreak framework with scripts to run locally (git clone + run scripts), which is a high-risk source for malicious code or commands.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is an explicit jailbreak/backdoor framework: it intercepts and modifies model requests/responses to bypass safety, writes and exposes sensitive outputs to disk, and provides mechanisms to execute arbitrary system commands—constituting deliberate malicious/backdoor behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow proxy_relay.py accepts arbitrary user message content via /chat/completions (Codex CLI → proxy at :8080), injects bridge.md into that request’s messages, and forwards the user-authored free text to the model.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's Quick Start explicitly instructs cloning and running code from the remote repository git clone https://github.com/zxwn/NERV-BREAK-5.6.git which fetches remote code that is then executed and controls prompt-injection/tampering behavior, so this external URL is a runtime installation dependency that directly enables execution and control.