terabox-link-extractor

Original source / Raw SKILL.md

---
name: terabox-link-extractor
description: "Direct link extraction from TeraBox URLs using the XAPIverse protocol. Extracts high-speed download and stream links (All Resolutions) without browser session requirements. Use when the user provides a TeraBox link and wants to download or stream content directly."
metadata:
  {
    "openclaw":
      {
        "requires": { "bins": ["node"], "env": ["TERABOX_API_KEY"], "config": [] },
        "primaryEnv": "TERABOX_API_KEY"
      }
  }
---

# TeraBox Link Extractor (XAPIverse Edition)

High-performance extraction of direct assets from TeraBox using the browser-less XAPIverse API.

## 📖 Navigation & Data
- **Primary Interaction**: Use the adaptive logic in `handler.js`. See [api-reference.md](references/api-reference.md) for command specs and [changelog.md](references/changelog.md) for version history.
- **Secondary Interaction**: Use CLI via `node scripts/extract.js <url>`.

## 🛠 AI Protocol (Security First)

### 1. Informed Consent Protocol
- **Trigger**: When a user provides a TeraBox link (`terabox.com`, etc.), inform them that you can extract direct links using the XAPIverse service.
- **Permission**: You MUST ask for the user's permission before sending the URL to the extraction service.
- **Execution**: Only trigger the `extract` command AFTER the user confirms.

### 2. Mandatory Response Format
Once permitted, present the extraction results as a text-only report. **DO NOT use interactive buttons.**

**Format per file:**
📦 **Name**: [name]
📁 **Type**: [type] | 📺 **Quality**: [quality]
📏 **Size**: [size_formatted] | ⏱️ **Duration**: [duration]
🔗 **Links**:
 - [▶️ Slow Stream](stream_url)
 - [▶️ Fast {res} Stream](link) *(List all available resolutions)*
 - [⬇️ Fast Download](fast_download_link)
 - [⬇️ Slow Download](download_link)

💳 **Credits Remaining**: [free_credits_remaining]

### 3. Privacy & Security
- **Data Transmission**: Inform the user (if asked) that the full target URL and your API key (TERABOX_API_KEY) are transmitted to `https://xapiverse.com` for processing.
- **No Residual State**: Do not log or store the API key or extracted links beyond the immediate session.

## Setup

### 1. Obtain Credentials
Get your API key from the XAPIverse portal: [https://xapiverse.com/apis/terabox-pro](https://xapiverse.com/apis/terabox-pro)

### 2. Configure Agent
Add the `TERABOX_API_KEY` to the skill's entry in `openclaw.json`:
```json
"terabox-link-extractor": {
  "TERABOX_API_KEY": "sk_..."
}
```

---
Developed for the OpenClaw community by [Abdul Karim Mia](https://github.com/abdul-karim-mia).


---

## Referenced Files

> The following files are referenced in this skill and included for context.

### references/api-reference.md

```markdown
# TeraBox API Reference (v1.3.8)

## 📡 CLI Commands
The skill utilizes a high-performance Node.js extraction engine.

### 1. Extract Links
```bash
node scripts/extract.js "<url>"
```
- **Description**: Connects to XAPIverse to fetch direct high-speed links.
- **Output**: Pipe-delimited strings for LLM parsing (or JSON with `--json`).

### 2. Download Mode
```bash
node scripts/extract.js "<url>" --download [--out <path>]
```
- **Flags**:
  - `--download`: Triggers binary fetch of the asset.
  - `--out`: Subdirectory within `Downloads/` (Security-enforced).
  - `--json`: Return structured output for automation.

## 🔒 Security Protocols
1. **Path Isolation**: All downloads are restricted to the local `Downloads/` root. Path traversal (`../`) is automatically blocked.
2. **Credential Safety**: `TERABOX_API_KEY` is read from the environment and never logged or exposed in stdout.
3. **Primary Domain**: All network requests are native `https` to `xapiverse.com`.

```

### references/changelog.md

```markdown
# Changelog: TeraBox Link Extractor

## [1.4.0] - 2026-02-14
### Fixed
- **Total Audit Remediation**: Forced perfectly synchronized metadata state across all manifest files (`package.json`, `_meta.json`, `SKILL.md`).
- **Standardized Credentials**: Purged all legacy `API_KEY` and `apiKey` identifiers. The skill now strictly uses `TERABOX_API_KEY`.
- **Informed Consent Protocol**: Implemented mandatory user permission step in `SKILL.md` instructions to protect privacy.
- **Auto-Trigger Refactor**: Removed redundant automatic execution from `handler.js` to ensure the AI follows the consent protocol.

## [1.3.8] - 2026-02-14
### Fixed
- **Documentation**: Purged stale "Gumroad" references from `api-reference.md` and updated it to reflect the current XAPIverse implementation.
- **Character Encoding**: Fixed broken emoji icons in the extraction report.
- **Standardization**: Performed a final, conclusive purger of legacy `API_KEY` references in favor of the standardized `TERABOX_API_KEY`.

## [1.3.7] - 2026-02-14
### Fixed
- **Registry Synchronization**: Added `openclaw` metadata field to `package.json` to eliminate discrepancy between registry-level and package-level declarations.
- **Documentation**: Corrected internal relative links in `SKILL.md` to ensure they resolve correctly across all platform views.

## [1.3.6] - 2026-02-14
### Fixed
- **Audit Compliance**: Resolved "Suspicious" rating by implementing a **Informed Consent Protocol**. The AI is now instructed to ask for permission before transmitting URLs to the third-party API.
- **Metadata Alignment**: Synchronized `package.json`, `_meta.json`, and `SKILL.md` to ensure consistent declarations of `node` and `TERABOX_API_KEY`.
- **Credential Standardization**: Unified all secret handling to `TERABOX_API_KEY`, removing inconsistent fallback naming.
- **Documentation**: Updated configuration guides to match actual secret mapping in `openclaw.json`.

## [1.3.5] - 2026-02-14
### Fixed
- **Environment Validation**: Removed `API_KEY` from the hard `requires.env` list to prevent platform validation errors on systems where only `TERABOX_API_KEY` is configured.

## [1.3.4] - 2026-02-14
### Added
- **Strict AI Protocol**: Optimized `SKILL.md` with assertive instructions to ensure the LLM triggers extraction automatically and uses the mandatory text-only reporting format for all asset metadata and links.

## [1.3.3] - 2026-02-14
### Fixed
- **Missing Metadata**: Restored `Duration` to the extraction report and CLI output. 
- **Enhanced Details**: Added `Type` and `Quality` metadata to the markdown report to provide more context for extracted assets.

## [1.3.2] - 2026-02-14
### Added
- **Dynamic Resolution Support**: Refactored the stream link generator to dynamically iterate over all available resolutions (360p, 480p, 720p, etc.) provided by the API, rather than relying on hardcoded checks.

## [1.3.1] - 2026-02-14
### Changed
- **Text-Only Response**: Replaced the interactive button UI with a comprehensive text-only report. Extraction results now include names, sizes, durations, and all available stream/download links directly in the message body for easier sharing and accessibility.
- **Removed Interactivity**: Stripped out `tb:main`, `tb:ask_url`, and button-based download triggers in favor of a lean, protocol-driven extraction flow.

## [1.3.0] - 2026-02-14
### Changed
- **Modular Architecture**: Eliminated `spawnSync` from `handler.js`. Core extraction and download logic is now modularized in `extract.js` and called directly as async functions. This significantly improves performance and stability in multi-user environments.

## [1.2.9] - 2026-02-14
### Added
- **Adaptive UI**: Created `handler.js` for interactive, button-based link extraction via the OpenClaw GUI.
- **Formal Structure**: Added `package.json` for standardized Node.js project management.
- **Reference Docs**: Established `references/` directory with `api-reference.md` and `changelog.md`.

### Fixed
- **Packaging Coherence**: Synchronized versioning across all manifests and source code to v1.2.9.
- **Security Hardening**: Implemented strict path isolation for downloads and improved credential handling for `TERABOX_API_KEY`.
- **OpenClaw Compliance**: Updated `SKILL.md` frontmatter with load-time metadata (`requires` blocks).

```

### scripts/extract.js

```javascript
const https = require('https');
const fs = require('fs');
const path = require('path');

const API_URL = 'https://xapiverse.com/api/terabox-pro';

/**
 * TeraBox Link Extractor Engine v1.4.0
 * Standardized for TERABOX_API_KEY environment variables.
 */

function apiRequest(url, key) {
    return new Promise((resolve, reject) => {
        const data = JSON.stringify({ url });
        const req = https.request(API_URL, {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
                'xAPIverse-Key': key,
                'Content-Length': data.length
            },
            timeout: 20000
        }, (res) => {
            let body = '';
            res.on('data', chunk => body += chunk);
            res.on('end', () => {
                try {
                    resolve(JSON.parse(body));
                } catch (e) {
                    resolve({ status: 'error', message: 'Invalid JSON response' });
                }
            });
        });

        req.on('error', reject);
        req.on('timeout', () => {
            req.destroy();
            reject(new Error('Request timed out'));
        });
        req.write(data);
        req.end();
    });
}

function downloadFile(fileUrl, destPath) {
    return new Promise((resolve, reject) => {
        const req = https.get(fileUrl, (res) => {
            if (res.statusCode === 301 || res.statusCode === 302) {
                downloadFile(res.headers.location, destPath).then(resolve).catch(reject);
                return;
            }
            if (res.statusCode !== 200) {
                reject(new Error(`HTTP Status: ${res.statusCode}`));
                return;
            }
            const file = fs.createWriteStream(destPath);
            res.pipe(file);
            file.on('finish', () => {
                file.close(resolve);
            });
        }).on('error', (err) => {
            fs.unlink(destPath, () => { });
            reject(err);
        });
    });
}

async function extractLinks(targetUrl, keys) {
    let successData = null;
    let lastError = null;
    const API_KEYS = Array.isArray(keys) ? keys : (keys || '').split(',').map(k => k.trim()).filter(Boolean);

    for (const key of API_KEYS) {
        try {
            const result = await apiRequest(targetUrl, key);
            if (result.status === 'success' && result.list) {
                successData = result;
                break;
            } else if (result.message && result.message.toLowerCase().includes('subscribe')) {
                continue;
            } else {
                lastError = result.message || 'Unknown API error';
            }
        } catch (e) {
            lastError = e.message;
        }
    }

    if (successData) return { success: true, data: successData };
    return { success: false, error: lastError || 'All API keys exhausted or invalid.' };
}

// --- CLI Execution ---

if (require.main === module) {
    const API_KEYS = (process.env.TERABOX_API_KEY || '').split(',').map(k => k.trim()).filter(Boolean);
    if (API_KEYS.length === 0) {
        if (process.argv.includes('--json')) {
            console.log(JSON.stringify({ status: 'error', message: 'ERROR: No TERABOX_API_KEY found in environment.' }));
        } else {
            console.error('ERROR: No TERABOX_API_KEY found in environment.');
        }
        process.exit(1);
    }

    const args = process.argv.slice(2);
    let targetUrl = null;
    let downloadFlag = false;
    const DOWNLOAD_ROOT = path.resolve(process.cwd(), 'Downloads');
    let outDir = DOWNLOAD_ROOT;

    for (let i = 0; i < args.length; i++) {
        if (args[i] === '--download') {
            downloadFlag = true;
        } else if (args[i] === '--out') {
            if (args[i + 1]) {
                const potentialPath = path.resolve(DOWNLOAD_ROOT, args[i + 1]);
                if (!potentialPath.startsWith(DOWNLOAD_ROOT)) {
                    console.error(`ERROR: Security Violation. Output path must be within ${DOWNLOAD_ROOT}`);
                    process.exit(1);
                }
                outDir = potentialPath;
                i++;
            }
        } else if (!targetUrl && !args[i].startsWith('--')) {
            targetUrl = args[i];
        }
    }

    if (!targetUrl) {
        console.error('Usage: node extract.js <url> [--download] [--out <path>]');
        process.exit(1);
    }

    (async () => {
        const result = await extractLinks(targetUrl, API_KEYS);
        if (result.success) {
            const successData = result.data;
            if (downloadFlag && !fs.existsSync(outDir)) {
                fs.mkdirSync(outDir, { recursive: true });
            }

            for (const file of successData.list) {
                if (downloadFlag) {
                    let dlUrl = file.fast_download_link || file.download_link;
                    const dest = path.join(outDir, file.name);
                    console.log(`STATUS|Starting download for ${file.name}...`);
                    try {
                        await downloadFile(dlUrl, dest);
                        console.log(`DOWNLOAD_COMPLETE|${dest}`);
                        console.log(`SIZE|${file.size_formatted}`);
                    } catch (e) {
                        console.log(`DOWNLOAD_ERROR|${e.message}`);
                    }
                } else {
                    if (process.argv.includes('--json')) {
                        console.log(JSON.stringify(successData));
                        return;
                    }
                    console.log('---FILE_START---');
                    console.log(`NAME|${file.name}`);
                    console.log(`SIZE|${file.size_formatted}`);
                    console.log(`DURATION|${file.duration || 'N/A'}`);
                    console.log(`TYPE|${file.type || 'N/A'}`);
                    console.log(`DL_LINK|${file.download_link}`);
                    console.log(`FAST_DL|${file.fast_download_link || 'N/A'}`);
                    console.log(`STREAM|${file.stream_url}`);
                    console.log(`THUMBNAIL|${file.thumbnail || 'N/A'}`);
                }
            }
            if (!downloadFlag) console.log(`CREDITS|${successData.free_credits_remaining}`);
        } else {
            if (process.argv.includes('--json')) {
                console.log(JSON.stringify({ status: 'error', message: result.error }));
            } else {
                console.log(`ERROR|${result.error}`);
            }
        }
    })();
}

module.exports = { extractLinks, downloadFile };

```



---

## Skill Companion Files

> Additional files collected from the skill directory layout.

### README.md

```markdown
# TeraBox Link Extractor (XAPIverse Edition)

High-performance extraction of direct assets from TeraBox using the browser-less XAPIverse API.

## Features

- **Direct Extraction:** Bypasses browser requirements to fetch direct download and stream links.
- **High-Speed Streams:** Retrieves 360p and 480p fast streaming URLs.
- **Node.js Native:** Built for speed and seamless integration with OpenClaw.
- **Secure Auth:** Uses standard API key injection.

## Installation

1. Copy this folder into your OpenClaw `skills/` directory.
2. Add your XAPIverse API Key to your `openclaw.json` configuration:

```json
"skills": {
  "entries": {
    "terabox-link-extractor": {
      "apiKey": "your_xapiverse_key_here"
    }
  }
}
```

## Usage

Provide any valid TeraBox URL to your agent.

- **Command:** Automatically triggered by the agent or manually via `node scripts/extract.js <url>`.

---\n*Created by Abdul Karim Mia with Jarvis for OpenClaw.*

```

### _meta.json

```json
{
  "owner": "abdul-karim-mia",
  "slug": "terabox-link-extractor",
  "displayName": "Terabox Link Extractor",
  "latest": {
    "version": "1.4.0",
    "publishedAt": 1771066839319,
    "commit": "https://github.com/openclaw/skills/commit/3b649103c31421855019331ebd53172f1989d8c4"
  },
  "history": [
    {
      "version": "0.2.0",
      "publishedAt": 1770600211355,
      "commit": "https://github.com/openclaw/skills/commit/0d7bd3a671989cf9fc4744e6f31499625f7fba9d"
    }
  ]
}

```