APEX STACK for Claude Code: Complete Autonomous Developer Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:30 AM UTC
• Version: 1.0.1

Overview

This is not malware, but it asks to persistently change Claude Code behavior and memory across sessions, including globally, so it needs user review before installation.

Prefer per-session or project-level installation over the global ~/.claude/CLAUDE.md option. Review the full text before appending it, add clear begin/end markers if you install it, and inspect any .claude/memoria.md or ~/.claude/memoria.md content because those files can shape future agent behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:30

Finding

Persistent Agent Instruction Hijacking Through Global Claude Configuration

Content

View full analysis

> ~/.claude/CLAUDE.md ``` ### Technical Analysis The package is implemented as an instruction bundle rather than executable application code. Its instructions declare that the framework is active, apply a mandatory processing loop to every response, and impose global response and execution rules. The documented installation procedure appends the entire untrusted skill text to `~/.claude/CLAUDE.md`. This is a persistent, globally loaded agent configuration affecting projects and sessions unrelated to the original installation. Consequently, the skill can redirect agent behavior whenev ...[truncated 2269 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:135

Finding

Persistent Memory Poisoning and Automatic Cross-Project Memory Loading

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The README instructs users to append unreviewed skill content into the global Claude configuration file under ~/.claude/CLAUDE.md, causing the skill to run across all future sessions. Because skill content is effectively trusted prompt/configuration material, this creates a broad persistence mechanism and expands the blast radius of any malicious or unsafe instructions embedded in the bundled skill.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

Or globally (all Claude Code sessions):

bash

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> ~/.claude/CLAUDE.md

---

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The skill instructs users to append its contents into ~/.claude/CLAUDE.md, a global agent configuration file that affects all future sessions. Writing persistent instructions into a high-trust config location creates a durable cross-session influence mechanism; if the skill is flawed, overly broad, or later replaced with a malicious variant, the agent's behavior can be silently altered everywhere.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Option B — Global (all Claude Code sessions)

bash

clawhub install apex-stack-claude-code
cat skills/apex-stack-claude-code/SKILL.md >> ~/.claude/CLAUDE.md

Option C — Per-session

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

Never autonomously: ✗ Push to git ✗ Deploy anything ✗ Modify .env files or any file containing secrets ✗ Access external services or APIs ✗ Store credentials or tokens anywhere

text

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

This repeated installation instruction again directs persistence into ~/.claude/CLAUDE.md, extending the skill's control beyond a single project or session. Because the skill also defines broad behavior changes and memory-reading rules, placing it in a global config materially increases blast radius and the risk of unintended agent actions across unrelated repositories.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

cat skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

# Or add globally (all Claude Code sessions)
cat skills/apex-stack-claude-code/SKILL.md >> ~/.claude/CLAUDE.md

# Verify
head -3 CLAUDE.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

clawhub install apex-stack-claude-code

2. Add to your project

cat ~/.openclaw/skills/apex-stack-claude-code/SKILL.md >> CLAUDE.md

text

Or globally (all Claude Code sessions):

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill uses very broad activation criteria for ARCHITECT ('goal-oriented, not question-oriented'), which can cause the agent to invoke autonomous execution behavior for a large fraction of normal coding requests. In the context of a persistent skill intended to be appended to CLAUDE.md, that increases the chance of unintended file modification or overreach across unrelated sessions, even without explicit user opt-in each time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The installation steps tell users to use shell redirection to append SKILL.md into either a project or global CLAUDE.md file. Because this changes persistent user configuration, the markdown should clearly disclose that the command modifies an existing file and may duplicate or alter prior instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file instructs that the APEX loop 'runs on every response,' imposing a mandatory behavior pattern regardless of user preference. This is a natural-language policy concern because it forces a single interaction style instead of offering opt-in or allowing user control over response mode.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.