Looks like someone added this as "permission", and then at action. I think its ok to remove it.

@FilipGCI Just ran git grep --text right-create-userbox, and git grep --text action-create-userbox, both returned no results (only showed they exist in the English and Finnish i18n files). Feel free to remove both :)

@SamanthaNguyen: Looks like there's more unneeded messages. Will do small research on it

@FilipGCI I'm currently working on a patch for that and already have some progress, I'm planning to submit which will fix this, T155364, and T155272 (which included @DatGuy's comment on fixing prefixes for the i18n messages). Sorry, I should've self-assigned this ticket as well as others. Do you still want to work on this one?

They are the same message and one is in lowercase because that's the expected format. The right-* messages are used on [[Special:ListGroupRights]], the action-* messages are technically shown on the respective special page ([[Special:UserBoxes]] in this case), although like many other social tools, FanBoxes redirects anons to the login page instead of displaying a permissions error the way many other extension do; grep will return no results for these messages in most cases, but despite not being directly used by the extension in question, core refers to them and expects them to exist (and this is something you just have to know).

I was gonna close this as INVALID but now I'm not sure, the action-* message might indeed be unused. Someone should test this out; what's the error message shown on [[Special:UserBoxes]] if and when you give the create-userbox right to a group that you're not a member of (say, bureaucrat for example) and then as a logged-in user you try to access that special page?