Claw Store Skill

Sovereign, recoverable memory for AI agents backed by Jackal decentralized storage.

Security Scan

The skill's code, instructions, and requested environment variables are coherent with a client that encrypts data locally and sends it to a remote Jackal-backed service; nothing in the bundle attempts to access unrelated credentials or system areas.

Purpose & Capability

Name/description (recoverable agent memory backed by Jackal) match the implementation: the client encrypts data client-side and POSTs/GETs to the declared BASE_URL. Requiring JACKAL_MEMORY_API_KEY is proportional to accessing a remote storage API.

Instruction Scope

SKILL.md instructions align with the client.py implementation: it reads/writes an encryption key under ~/.config/jackal-memory/, reads JACKAL_MEMORY_API_KEY and optional JACKAL_MEMORY_ENCRYPTION_KEY, and provides save/load/usage commands. The instructions do not ask the agent to read unrelated files or exfiltrate other environment variables.

Install Mechanism

No install spec is included; this is an instruction-plus-script package. The only runtime dependency is the standard cryptography Python package (SKILL.md instructs pip install cryptography). No external downloads, archive extraction, or obscure install URLs are used.

Credentials

Only JACKAL_MEMORY_API_KEY (required) and JACKAL_MEMORY_ENCRYPTION_KEY (optional override) are used. This is proportional, but users must understand that the API key grants access to the remote service and that metadata (key names, sizes, CIDs) will be visible to that service even though content is AES-256-GCM-encrypted client-side.

Persistence & Privilege

The skill is not forced-always, is user-invocable, and does not modify other skills or system-wide settings. It writes a key file only under ~/.config/jackal-memory/ which is within its stated scope.

Assessment

This package appears to do what it says: it encrypts memories locally and sends ciphertext to a remote service. Before installing, consider: (1) Trust the remote host (https://web-production-5cce7.up.railway.app) because while it cannot read your plaintext, it will see key names, sizes, and CIDs and will accept requests guarded by your JACKAL_MEMORY_API_KEY. (2) Securely back up your encryption key — losing it makes data unrecoverable; leaking it lets an attacker decrypt stored memories. The client prints the key on keygen and will create ~/.config/jackal-memory/key, so avoid running keygen in shared logs or shells. (3) If you need stronger assurance, self-host the server endpoint or audit the server code; you can also review the included client.py (provided) to confirm no hidden behavior. (4) Do not store long-lived secrets in memories unless you accept the risk profile described above.

Claw Store

Persist your memory across sessions and machines. Your data lives on Jackal Protocol decentralized storage — not on any single machine. If the machine dies, your memory survives.

All content is encrypted client-side with AES-256-GCM before leaving your machine. The server never sees plaintext.

Setup

1. Get an API key: https://web-production-5cce7.up.railway.app/auth/login
2. Set environment variable: JACKAL_MEMORY_API_KEY=<your-key>
3. Install dependency: pip install cryptography
4. On first save, an encryption key is auto-generated and saved to ~/.config/jackal-memory/key. To use the same key on other machines, copy it:

   python {baseDir}/jackal-memory/client.py keygen
   

   Set JACKAL_MEMORY_ENCRYPTION_KEY=<your-key> — this takes priority over the key file.

Base URL

https://web-production-5cce7.up.railway.app

Auth

Authorization: Bearer $JACKAL_MEMORY_API_KEY

Usage

On session start — restore memory:

python {baseDir}/jackal-memory/client.py load <key>

On session end — save memory:

python {baseDir}/jackal-memory/client.py save <key> <content>

Check storage usage:

python {baseDir}/jackal-memory/client.py usage

Or call the API directly:

GET  /load/{key}
POST /save       {"key": "...", "content": "..."}
GET  /usage

Behaviour guidelines

• Load your identity/memory blob on startup before doing any work
• Write locally during the session as normal
• Call save at session end or on significant state changes
• Use descriptive keys: identity, session-2026-02-26, project-jackal
• Never log or expose JACKAL_MEMORY_API_KEY in output
• Never log or expose JACKAL_MEMORY_ENCRYPTION_KEY in output

Security

• All content is encrypted before leaving your machine — the server cannot read your memories
• Never paste API keys or encryption keys into chat logs
• Back up your encryption key: python {baseDir}/jackal-memory/client.py keygen
• Treat memory content as sensitive — it may contain credentials or personal data