Skillv0.1.0

ClawScan security

Jackal Memory · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 26, 2026, 8:59 PM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill appears internally consistent: it provides a small client that sends/receives agent memory to a remote Jackal-backed web service and only requires a single API key, but you must trust the remote endpoint because your memory is transmitted to it.
Guidance: Before installing: confirm you trust the remote service at https://web-production-5cce7.up.railway.app because all saved memory content is sent there in plaintext via the provided client. If you handle secrets or personal data, consider: (1) testing with non-sensitive data first, (2) rotating any API key you provide, (3) checking whether the API key can be scoped or revoked, (4) asking the publisher for proof this is an official Jackal-backed service or for self-hosting instructions, and (5) reviewing the included client.py (it’s small and uses only stdlib) and your agent's logs to avoid accidental leakage of secrets. If you are uncomfortable trusting the endpoint, do not provide the API key or consider self-hosting an equivalent service.

Purpose & Capability: noteName/description, SKILL.md, and the included client.py align: the skill stores and restores memory via an HTTP API and requires JACKAL_MEMORY_API_KEY. A minor note: the BASE_URL and homepage point to a Railway deployment (web-production-5cce7.up.railway.app) rather than an official 'jackalprotocol' domain; this is not incoherent but is worth verifying with the author/operator.
Instruction Scope: noteRuntime instructions are scoped to save/load/provision operations against the stated API and to reading JACKAL_MEMORY_API_KEY. The instructions do cause agent memory content (plaintext) to be transmitted to the external service; they do not read local files or unrelated environment variables. Verify you are comfortable sending sensitive memory to that external host.
Install Mechanism: okNo install spec; this is instruction-only with a small Python stdlib client included. Nothing is downloaded or executed on install beyond the provided client.
Credentials: okOnly a single environment variable (JACKAL_MEMORY_API_KEY) is required, which matches the API-based behavior. No unrelated credentials or config paths are requested.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request persistent system-wide privileges or modify other skills' configurations.