← Back to Skills Marketplace
zanyk4502

DeBox Community

by ZanyK4502 · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
249
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install debox-community-zanyk
Description
Manage DeBox communities, DAOs, and NFT groups. Use when you need to verify group membership, check voting/lottery participation, query group info, or valida...
README (SKILL.md)

DeBox Community Management

Manage DeBox communities, verify membership, and analyze community engagement.

Quick Start

Configuration

Set the DEBOX_API_KEY environment variable:

export DEBOX_API_KEY="your-api-key"

Or add to ~/.openclaw/workspace/debox-community/config.json:

{
  "apiKey": "your-api-key",
  "defaultGroupId": "optional-default-group-id"
}

Get your API Key from https://developer.debox.pro

Commands

Personal Data Report (推荐)

查看你的 DeBox 个人数据报告：

node scripts/debox-community.js profile --user-id "abc123"

Returns: 昵称、用户ID、钱包地址、等级、点赞数据

如何获取 user_id：

  1. 打开 DeBox App
  2. 进入个人主页
  3. 点击分享，复制链接
  4. 链接中的 id 参数就是 user_id

Group Info

Query group information:

node scripts/debox-community.js info --url "https://m.debox.pro/group?id=fxi3hqo5"

Returns: group name, member count, description, creator.

Member Verification

Check if a user is in a group:

node scripts/debox-community.js check-member --wallet "0x2267..." --group-url "https://m.debox.pro/group?id=fxi3hqo5"

Returns: boolean membership status.

User Profile

Get user profile information (nickname, avatar, wallet address):

node scripts/debox-community.js user-info --user-id "abc123"

Returns: user_id, nickname, avatar, wallet address.

Note: This API only supports user_id, not wallet address.

Vote Stats

Query user's voting activity in a group:

node scripts/debox-community.js vote-stats --wallet "0x2267..." --group-id "fxi3hqo5"

Returns: vote count, recent votes.

Lottery Stats

Query user's lottery participation:

node scripts/debox-community.js lottery-stats --wallet "0x2267..." --group-id "fxi3hqo5"

Returns: lottery count, win history.

Praise Info

Get user's praise/like data:

node scripts/debox-community.js praise-info --wallet "0x2267..." --chain-id 1

Returns: total likes received, recent praise.

Comprehensive Verification

Verify user eligibility with multiple criteria:

node scripts/debox-community.js verify --wallet "0x2267..." --group-url "..." --min-votes 5 --min-lotteries 1

Returns: pass/fail status with detailed breakdown.

API Reference

See references/api.md for complete API documentation.

Use Cases

DAO Membership Verification

Verify if a user is a DAO member with voting history:

node scripts/debox-community.js verify --wallet "0xabc..." --group-url "https://m.debox.pro/group?id=dao123" --min-votes 1

NFT Community Access

Verify NFT holder is in community group:

node scripts/debox-community.js check-member --wallet "0xabc..." --group-url "https://m.debox.pro/group?id=nft456"

Whitelist Generation

Batch verify multiple wallets:

node scripts/debox-community.js batch-verify --file wallets.txt --group-url "..." --min-votes 3

Error Handling

Error Cause Solution
INVALID_API_KEY API key missing or invalid Check configuration
GROUP_NOT_FOUND Group ID/URL invalid Verify group URL format
USER_NOT_FOUND Wallet address not registered Confirm user has DeBox account
RATE_LIMIT Too many requests Wait and retry

Environment Variables

Variable Required Description
DEBOX_API_KEY Yes Your DeBox API key
DEBOX_DEFAULT_GROUP No Default group ID for commands
Usage Guidance
This skill implements DeBox API calls and mostly does what its description says, but there are important red flags you should address before installing or using it: - Do not trust the API key bundled in config.json. Treat it as sensitive: either remove the file or replace the key with your own. If that key looks like a real credential, assume it may be active and consider asking the publisher to confirm or revoke it. - The registry metadata omitted required env vars; the CLI actually needs DEBOX_API_KEY (set via env or config). Prefer setting DEBOX_API_KEY as an environment variable rather than leaving credentials in a file inside the skill folder. - The package installs native image libraries (canvas, sharp). These require native toolchains and can execute code during npm install. If you must install, do so in a sandboxed environment or CI runner and review npm install output. - Confirm the API base (https://open.debox.pro/openapi) and endpoints are the official DeBox developer endpoints. If you have doubts, verify against DeBox's official docs or developer portal. - The code reads files you provide (e.g., wallets.txt) for batch operations; ensure you do not feed private wallet lists or other sensitive data unless necessary. If you are not comfortable with the embedded key or the native dependency install steps, do not install the skill. If you proceed, remove the bundled config.json (or replace its apiKey), set DEBOX_API_KEY in your environment, and consider running npm install inside an isolated container. If the included apiKey is a real, untrusted key, ask the publisher to rotate/revoke it.
Capability Analysis
Type: OpenClaw Skill Name: debox-community-zanyk Version: 1.0.0 The skill bundle contains a hardcoded API key and default group ID within `config.json`, which is a security vulnerability (credential leakage). The main script `scripts/debox-community.js` performs network requests to the DeBox API (open.debox.pro) and downloads user avatars from arbitrary URLs for image processing via the `sharp` library, which represents a potential SSRF surface. While the code logic appears consistent with the stated purpose of managing DeBox communities, the inclusion of active credentials and the handling of remote image artifacts are high-risk behaviors.
Capability Assessment
⚠ Purpose & Capability
The skill's stated purpose (DeBox community queries) matches the code and docs. However the registry metadata declared no required environment variables while SKILL.md and the CLI require DEBOX_API_KEY (and optionally DEBOX_DEFAULT_GROUP). That mismatch is an incoherence and reduces trust.
ℹ Instruction Scope
SKILL.md and scripts only describe querying the DeBox API and local files (e.g., wallets.txt for batch-verify). This stays within the stated purpose. Two issues: (1) SKILL.md tells users to place a config.json under ~/.openclaw/workspace/debox-community, but the code reads ../config.json relative to the scripts folder (potential path mismatch). (2) The repository includes a config.json containing an apiKey value — embedding a key in the package contradicts the guidance to set your own API key and may leak a credential.
ℹ Install Mechanism
There is no remote install script in the skill bundle (instruction-only install), but package.json lists native image libraries (canvas, sharp). Installing those requires native build steps and pulls optional native binaries via npm; this is expected because the CLI can generate image reports, but it increases installation complexity and attack surface compared to a pure-JS tool.
⚠ Credentials
The skill legitimately needs a DeBox API key, but the registry metadata failed to declare it. More importantly, the package includes a config.json with an API key value (cleartext). Shipping a credential inside the skill is disproportionate and risky — if that key is valid it could be abused, rate-limited, or revoked; if it's someone else's key it may indicate sloppy handling or deliberate leaking.
✓ Persistence & Privilege
The skill is not always-enabled and does not request elevated system privileges or modify other skills. It runs as a normal CLI skill and reads local files the user supplies (wallet lists, config).
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install debox-community-zanyk
  3. After installation, invoke the skill by name or use /debox-community-zanyk
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial public release
Metadata
Slug debox-community-zanyk
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is DeBox Community?

Manage DeBox communities, DAOs, and NFT groups. Use when you need to verify group membership, check voting/lottery participation, query group info, or valida... It is an AI Agent Skill for Claude Code / OpenClaw, with 249 downloads so far.

How do I install DeBox Community?

Run "/install debox-community-zanyk" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is DeBox Community free?

Yes, DeBox Community is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does DeBox Community support?

DeBox Community is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created DeBox Community?

It is built and maintained by ZanyK4502 (@zanyk4502); the current version is v1.0.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463942 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259883 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200739 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191401 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190375 · by oswalpalash

💬 Comments