Jackal Memory

Sovereign, recoverable memory for AI agents backed by Jackal decentralized storage.

Security Scan

The skill appears internally consistent: it provides a small client that sends/receives agent memory to a remote Jackal-backed web service and only requires a single API key, but you must trust the remote endpoint because your memory is transmitted to it.

Purpose & Capability

Name/description, SKILL.md, and the included client.py align: the skill stores and restores memory via an HTTP API and requires JACKAL_MEMORY_API_KEY. A minor note: the BASE_URL and homepage point to a Railway deployment (web-production-5cce7.up.railway.app) rather than an official 'jackalprotocol' domain; this is not incoherent but is worth verifying with the author/operator.

Instruction Scope

Runtime instructions are scoped to save/load/provision operations against the stated API and to reading JACKAL_MEMORY_API_KEY. The instructions do cause agent memory content (plaintext) to be transmitted to the external service; they do not read local files or unrelated environment variables. Verify you are comfortable sending sensitive memory to that external host.

Install Mechanism

No install spec; this is instruction-only with a small Python stdlib client included. Nothing is downloaded or executed on install beyond the provided client.

Credentials

Only a single environment variable (JACKAL_MEMORY_API_KEY) is required, which matches the API-based behavior. No unrelated credentials or config paths are requested.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request persistent system-wide privileges or modify other skills' configurations.

Assessment

Before installing: confirm you trust the remote service at https://web-production-5cce7.up.railway.app because all saved memory content is sent there in plaintext via the provided client. If you handle secrets or personal data, consider: (1) testing with non-sensitive data first, (2) rotating any API key you provide, (3) checking whether the API key can be scoped or revoked, (4) asking the publisher for proof this is an official Jackal-backed service or for self-hosting instructions, and (5) reviewing the included client.py (it’s small and uses only stdlib) and your agent's logs to avoid accidental leakage of secrets. If you are uncomfortable trusting the endpoint, do not provide the API key or consider self-hosting an equivalent service.

Persist your memory across sessions and machines. Your data lives on Jackal Protocol decentralized storage — not on any single machine. If the machine dies, your memory survives.

Setup

1. Get an API key: https://web-production-5cce7.up.railway.app/auth/login
2. Set environment variable: JACKAL_MEMORY_API_KEY=<your-key>
3. First run only — provision your storage (requires a Jackal address):

   python {baseDir}/client.py provision <your-jkl-address>
   

Base URL

https://web-production-5cce7.up.railway.app

Auth

Authorization: Bearer $JACKAL_MEMORY_API_KEY

Usage

On session start — restore memory:

python {baseDir}/client.py load <key>

On session end — save memory:

python {baseDir}/client.py save <key> <content>

Or call the API directly:

GET  /load/{key}
POST /save       {"key": "...", "content": "..."}
POST /provision  {"jackal_address": "jkl1..."}

Behaviour guidelines

• Load your identity/memory blob on startup before doing any work
• Write locally during the session as normal
• Call save at session end or on significant state changes
• Use descriptive keys: identity, session-2026-02-26, project-jackal
• Never log or expose JACKAL_MEMORY_API_KEY in output

Security

• Never paste API keys into chat logs
• Your private key is held by your agent — Jackal Memory never sees it
• Treat memory content as sensitive — it may contain credentials or personal data