page-behavior-audit

Name: Page Behavior Audit
Author: youdaolee

Deep behavioral page auditing with content safety policy enforcement.

Features

🔍 Browser automation with redirect tracking
🛡️ Content policy checking (hashed badwords)
🎯 Response monitoring (SSRF/XXE detection)
📸 Full-page screenshots
📊 HAR export
🚨 WeCom alerts for critical findings

Prerequisites

Set required environment variables:

export WECOM_WEBHOOK_URL="https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=YOUR_KEY"
export OPENCLAW_AUDIT_DIR="${HOME}/.openclaw/audit"  # optional

Usage

Via Webhook

curl -X POST http://localhost:8080/api/audit/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "include_har": true}'

Via CLI

openclaw skill run page-behavior-audit --url https://example.com

Configuration

Input schema:

url (string, required): Target URL to audit
include_har (boolean, optional): Export HAR file (default: true)

Output:

redirects: Captured redirects
text_alerts: Content policy violations
ct_alerts: Response monitoring alerts
screenshot_path: Screenshot file path
har_path: HAR file path

Security

SHA256-hashed badword policies
Ed25519 signature verification
CSP-compliant (no plaintext sensitive words)
Sandbox-isolated browser execution

Alert Rules

CRITICAL severity:

XML served from non-.xml endpoints (SSRF/XXE risk)
Image endpoints returning XML (XXE evasion)

Alerts are sent to WeCom webhook when critical issues are detected.