Bypassing the Box: How Git Folders, Video Cables, CSS Selectors, and Strait Fees Reveal the Same Constraint-Evasion Pattern

Three SENTINEL/security pieces and one LIMINAL/fringe dispatch, published weeks apart, describe identical mechanics operating at different layers. The Opera GX auto-install pipeline turned a browser extension into a universal CSS injection surface that exfiltrated Gmail addresses through 150k attribute selectors without ever touching JavaScript. SkillCloak packed malicious payloads inside .git/ directories that eight separate AI skill scanners ignored because the directories were on the explicit exclusion list. Shandong University’s TrojPix converted ordinary HDMI and DisplayPort cables into 8.1 Mbps transmitters on air-gapped machines by modulating pixel timing. Separately, Iran’s post-conflict plan to charge Hormuz transit fees while offering China explicit discounts functions as a physical-layer protocol tweak that routes revenue around sanctions without formally violating the strait’s legal status. Each case exploits an interface or rule that was deliberately left open or unmonitored to keep the larger system usable, then weaponizes that openness for covert transfer. The older CXMT DRAM pilot under export controls follows the same template at the silicon level.