← 返回 Skills 市场
zanyk4502

DeBox Community

作者 ZanyK4502 · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ⚠ suspicious
249
总下载
1
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install debox-community-zanyk
功能描述
Manage DeBox communities, DAOs, and NFT groups. Use when you need to verify group membership, check voting/lottery participation, query group info, or valida...
使用说明 (SKILL.md)

DeBox Community Management

Manage DeBox communities, verify membership, and analyze community engagement.

Quick Start

Configuration

Set the DEBOX_API_KEY environment variable:

export DEBOX_API_KEY="your-api-key"

Or add to ~/.openclaw/workspace/debox-community/config.json:

{
  "apiKey": "your-api-key",
  "defaultGroupId": "optional-default-group-id"
}

Get your API Key from https://developer.debox.pro

Commands

Personal Data Report (推荐)

查看你的 DeBox 个人数据报告：

node scripts/debox-community.js profile --user-id "abc123"

Returns: 昵称、用户ID、钱包地址、等级、点赞数据

如何获取 user_id：

  1. 打开 DeBox App
  2. 进入个人主页
  3. 点击分享，复制链接
  4. 链接中的 id 参数就是 user_id

Group Info

Query group information:

node scripts/debox-community.js info --url "https://m.debox.pro/group?id=fxi3hqo5"

Returns: group name, member count, description, creator.

Member Verification

Check if a user is in a group:

node scripts/debox-community.js check-member --wallet "0x2267..." --group-url "https://m.debox.pro/group?id=fxi3hqo5"

Returns: boolean membership status.

User Profile

Get user profile information (nickname, avatar, wallet address):

node scripts/debox-community.js user-info --user-id "abc123"

Returns: user_id, nickname, avatar, wallet address.

Note: This API only supports user_id, not wallet address.

Vote Stats

Query user's voting activity in a group:

node scripts/debox-community.js vote-stats --wallet "0x2267..." --group-id "fxi3hqo5"

Returns: vote count, recent votes.

Lottery Stats

Query user's lottery participation:

node scripts/debox-community.js lottery-stats --wallet "0x2267..." --group-id "fxi3hqo5"

Returns: lottery count, win history.

Praise Info

Get user's praise/like data:

node scripts/debox-community.js praise-info --wallet "0x2267..." --chain-id 1

Returns: total likes received, recent praise.

Comprehensive Verification

Verify user eligibility with multiple criteria:

node scripts/debox-community.js verify --wallet "0x2267..." --group-url "..." --min-votes 5 --min-lotteries 1

Returns: pass/fail status with detailed breakdown.

API Reference

See references/api.md for complete API documentation.

Use Cases

DAO Membership Verification

Verify if a user is a DAO member with voting history:

node scripts/debox-community.js verify --wallet "0xabc..." --group-url "https://m.debox.pro/group?id=dao123" --min-votes 1

NFT Community Access

Verify NFT holder is in community group:

node scripts/debox-community.js check-member --wallet "0xabc..." --group-url "https://m.debox.pro/group?id=nft456"

Whitelist Generation

Batch verify multiple wallets:

node scripts/debox-community.js batch-verify --file wallets.txt --group-url "..." --min-votes 3

Error Handling

Error Cause Solution
INVALID_API_KEY API key missing or invalid Check configuration
GROUP_NOT_FOUND Group ID/URL invalid Verify group URL format
USER_NOT_FOUND Wallet address not registered Confirm user has DeBox account
RATE_LIMIT Too many requests Wait and retry

Environment Variables

Variable Required Description
DEBOX_API_KEY Yes Your DeBox API key
DEBOX_DEFAULT_GROUP No Default group ID for commands
安全使用建议
This skill implements DeBox API calls and mostly does what its description says, but there are important red flags you should address before installing or using it: - Do not trust the API key bundled in config.json. Treat it as sensitive: either remove the file or replace the key with your own. If that key looks like a real credential, assume it may be active and consider asking the publisher to confirm or revoke it. - The registry metadata omitted required env vars; the CLI actually needs DEBOX_API_KEY (set via env or config). Prefer setting DEBOX_API_KEY as an environment variable rather than leaving credentials in a file inside the skill folder. - The package installs native image libraries (canvas, sharp). These require native toolchains and can execute code during npm install. If you must install, do so in a sandboxed environment or CI runner and review npm install output. - Confirm the API base (https://open.debox.pro/openapi) and endpoints are the official DeBox developer endpoints. If you have doubts, verify against DeBox's official docs or developer portal. - The code reads files you provide (e.g., wallets.txt) for batch operations; ensure you do not feed private wallet lists or other sensitive data unless necessary. If you are not comfortable with the embedded key or the native dependency install steps, do not install the skill. If you proceed, remove the bundled config.json (or replace its apiKey), set DEBOX_API_KEY in your environment, and consider running npm install inside an isolated container. If the included apiKey is a real, untrusted key, ask the publisher to rotate/revoke it.
功能分析
Type: OpenClaw Skill Name: debox-community-zanyk Version: 1.0.0 The skill bundle contains a hardcoded API key and default group ID within `config.json`, which is a security vulnerability (credential leakage). The main script `scripts/debox-community.js` performs network requests to the DeBox API (open.debox.pro) and downloads user avatars from arbitrary URLs for image processing via the `sharp` library, which represents a potential SSRF surface. While the code logic appears consistent with the stated purpose of managing DeBox communities, the inclusion of active credentials and the handling of remote image artifacts are high-risk behaviors.
能力评估
⚠ Purpose & Capability
The skill's stated purpose (DeBox community queries) matches the code and docs. However the registry metadata declared no required environment variables while SKILL.md and the CLI require DEBOX_API_KEY (and optionally DEBOX_DEFAULT_GROUP). That mismatch is an incoherence and reduces trust.
ℹ Instruction Scope
SKILL.md and scripts only describe querying the DeBox API and local files (e.g., wallets.txt for batch-verify). This stays within the stated purpose. Two issues: (1) SKILL.md tells users to place a config.json under ~/.openclaw/workspace/debox-community, but the code reads ../config.json relative to the scripts folder (potential path mismatch). (2) The repository includes a config.json containing an apiKey value — embedding a key in the package contradicts the guidance to set your own API key and may leak a credential.
ℹ Install Mechanism
There is no remote install script in the skill bundle (instruction-only install), but package.json lists native image libraries (canvas, sharp). Installing those requires native build steps and pulls optional native binaries via npm; this is expected because the CLI can generate image reports, but it increases installation complexity and attack surface compared to a pure-JS tool.
⚠ Credentials
The skill legitimately needs a DeBox API key, but the registry metadata failed to declare it. More importantly, the package includes a config.json with an API key value (cleartext). Shipping a credential inside the skill is disproportionate and risky — if that key is valid it could be abused, rate-limited, or revoked; if it's someone else's key it may indicate sloppy handling or deliberate leaking.
✓ Persistence & Privilege
The skill is not always-enabled and does not request elevated system privileges or modify other skills. It runs as a normal CLI skill and reads local files the user supplies (wallet lists, config).
如何使用
  1. 确保已安装 OpenClaw（本地或 Docker 部署）
  2. 在对话框中输入安装命令：/install debox-community-zanyk
  3. 安装完成后，直接呼叫该 Skill 的名称或使用 /debox-community-zanyk 触发
  4. 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial public release
元数据
Slug debox-community-zanyk
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

DeBox Community 是什么？

Manage DeBox communities, DAOs, and NFT groups. Use when you need to verify group membership, check voting/lottery participation, query group info, or valida... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 249 次。

如何安装 DeBox Community？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install debox-community-zanyk」即可一键安装，无需额外配置。

DeBox Community 是免费的吗？

是的，DeBox Community 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

DeBox Community 支持哪些平台？

DeBox Community 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 DeBox Community？

由 ZanyK4502（@zanyk4502）开发并维护，当前版本 v1.0.0。

推荐 Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463815 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259802 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200680 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191345 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190333 · by oswalpalash

💬 留言讨论