Terabox Link Extractor

Direct link extraction from TeraBox URLs using the XAPIverse protocol. Extracts high-speed download and stream links (360p/480p) without browser session requ...

Security Scan

The skill's code, runtime instructions, and required API key are consistent with its stated purpose (calling XAPIverse to extract TeraBox links), but it will transmit the user-supplied URL and your TERABOX_API_KEY to the third-party service — review trust and privacy before enabling.

Purpose & Capability

Name/description, node requirement, and TERABOX_API_KEY map directly to the code's behavior: scripts/extract.js posts the provided TeraBox URL to https://xapiverse.com/api/terabox-pro and returns download/stream links. There are no unrelated environment variables or binaries requested.

Instruction Scope

SKILL.md explicitly requires informed user consent before sending a URL and documents that the full target URL and API key are transmitted to xapiverse.com. The handler delegates consent handling to the LLM as described. This is within scope for an extraction skill, but it does mean user-provided URLs and the API key will leave the host environment.

Install Mechanism

No install script or remote downloads are present; the skill requires only a local Node runtime and contains plain JS files. There is no suspicious installer or external archive retrieval.

Credentials

Only one required credential (TERABOX_API_KEY) is declared and actually used. The code supports multiple comma-separated keys, which is reasonable for failover. The key is sent to the documented external API (xapiverse.com) — this is necessary for the service but is a privacy/secret-exposure consideration, not an incoherence.

Persistence & Privilege

The skill does not request permanent/always-on inclusion and does not attempt to modify other skills or system-wide agent settings. Downloads are sandboxed to a local Downloads/ directory per the code's checks.

Assessment

This skill appears to do what it says: it sends a TeraBox link and your TERABOX_API_KEY to XAPIverse (https://xapiverse.com) to obtain direct download/stream URLs. Before installing: (1) Verify you trust the XAPIverse service and its privacy/terms, because your API key and the full target URL will be transmitted there. (2) Use a dedicated, limited-scope API key (do not reuse high-privilege secrets). (3) Confirm that extracting and downloading the target content is legal and allowed by the content owner. (4) Note the skill enforces Downloads/ as the output root (path traversal is blocked). (5) The SKILL.md requires the agent to ask for explicit user permission before transmitting URLs — ensure your agent actually follows that consent flow if you need the extra privacy protection. Minor metadata inconsistencies (README examples vs. standardized TERABOX_API_KEY and a homepage field mismatch) look like documentation drift but do not affect execution.

TeraBox Link Extractor (XAPIverse Edition)

High-performance extraction of direct assets from TeraBox using the browser-less XAPIverse API.

📖 Navigation & Data

• Primary Interaction: Use the adaptive logic in handler.js. See api-reference.md for command specs and changelog.md for version history.
• Secondary Interaction: Use CLI via node scripts/extract.js <url>.

🛠 AI Protocol (Security First)

1. Informed Consent Protocol

• Trigger: When a user provides a TeraBox link (terabox.com, etc.), inform them that you can extract direct links using the XAPIverse service.
• Permission: You MUST ask for the user's permission before sending the URL to the extraction service.
• Execution: Only trigger the extract command AFTER the user confirms.

2. Mandatory Response Format

Once permitted, present the extraction results as a text-only report. DO NOT use interactive buttons.

Format per file: 📦 Name: [name] 📁 Type: [type] | 📺 Quality: [quality] 📏 Size: [size_formatted] | ⏱️ Duration: [duration] 🔗 Links:

• ▶️ Slow Stream
• ▶️ Fast {res} Stream (List all available resolutions)
• ⬇️ Fast Download
• ⬇️ Slow Download

💳 Credits Remaining: [free_credits_remaining]

3. Privacy & Security

• Data Transmission: Inform the user (if asked) that the full target URL and your API key (TERABOX_API_KEY) are transmitted to https://xapiverse.com for processing.
• No Residual State: Do not log or store the API key or extracted links beyond the immediate session.

Setup

1. Obtain Credentials

Get your API key from the XAPIverse portal: https://xapiverse.com/apis/terabox-pro

2. Configure Agent

Add the TERABOX_API_KEY to the skill's entry in openclaw.json:

"terabox-link-extractor": {
  "TERABOX_API_KEY": "sk_..."
}

---

Developed for the OpenClaw community by Abdul Karim Mia.