# Page Behavior Audit

> Deep behavioral audit with hashed policy (CSP-compliant, no plaintext badwords)

- Skill: `modbender/page-behavior-audit` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add modbender/page-behavior-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/modbender/page-behavior-audit/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: modbender (https://skillmd.com/u/modbender)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/modbender/page-behavior-audit

---


# page-behavior-audit

Deep behavioral page auditing with content safety policy enforcement.

## Features

- 🔍 Browser automation with redirect tracking
- 🛡️ Content policy checking (hashed badwords)
- 🎯 Response monitoring (SSRF/XXE detection)
- 📸 Full-page screenshots
- 📊 HAR export
- 🚨 WeCom alerts for critical findings

## Prerequisites

Set required environment variables:

```bash
export WECOM_WEBHOOK_URL="https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=YOUR_KEY"
export OPENCLAW_AUDIT_DIR="${HOME}/.openclaw/audit"  # optional
```

## Usage

### Via Webhook

```bash
curl -X POST http://localhost:8080/api/audit/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "include_har": true}'
```

### Via CLI

```bash
openclaw skill run page-behavior-audit --url https://example.com
```

## Configuration

**Input schema:**
- `url` (string, required): Target URL to audit
- `include_har` (boolean, optional): Export HAR file (default: true)

**Output:**
- `redirects`: Captured redirects
- `text_alerts`: Content policy violations
- `ct_alerts`: Response monitoring alerts
- `screenshot_path`: Screenshot file path
- `har_path`: HAR file path

## Security

- SHA256-hashed badword policies
- Ed25519 signature verification
- CSP-compliant (no plaintext sensitive words)
- Sandbox-isolated browser execution

## Alert Rules

**CRITICAL severity:**
- XML served from non-.xml endpoints (SSRF/XXE risk)
- Image endpoints returning XML (XXE evasion)

Alerts are sent to WeCom webhook when critical issues are detected.