page-behavior-audit

Deep behavioral audit with hashed policy (CSP-compliant, no plaintext badwords)

This skill is plausibly a page-auditor but has several red flags you should address before installing: 1) Packaging mismatch — the registry metadata claims no required env vars, but SKILL.md and skill.yaml require WECOM_WEBHOOK_URL and OPENCLAW_AUDIT_DIR; confirm requirements with the author. 2) Data exfiltration risk — alerts send the aggregated report (which may contain up to 10k chars of page text, links, redirects, HAR/screenshot paths) to the configured WeCom webhook. Only set WECOM_WEBHOOK_URL to a trusted internal webhook; for initial testing use a disposable/internal sink. 3) Signature/verification placeholders — the policy signature and verification_url appear not verifiable from the bundle; if policy integrity is important, ask for a real signing key and verification endpoint. 4) Installer privileges — install.sh can copy files under system paths when run with --system; avoid running as root unless you trust and have reviewed the package. 5) Local permissions file — .claude/settings.local.json contains broad Bash permissions; confirm why shell execution is needed and remove/lock down unneeded permissions. Recommended actions: review skill.yaml and SKILL.md in full, run the skill in an isolated environment (container or VM) against non-sensitive targets, set OPENCLAW_AUDIT_DIR to an isolated directory, use a safe/test webhook for alerts, and verify the policy signature/verification process with the maintainer before using on production targets.

Type: OpenClaw Skill Name: page-behavior-audit Version: 1.0.7 The skill bundle itself appears to be a legitimate web page auditing tool, using built-in OpenClaw actions for browser automation, content policy checks, and alert notifications. However, the `.claude/settings.local.json` file grants the OpenClaw agent extremely broad permissions, specifically `Bash(bash:*)`. This allows the agent to execute arbitrary shell commands, which is a significant vulnerability. While the `skill.yaml` does not directly exploit this, such a broad permission creates a critical attack surface for potential prompt injection or other forms of agent compromise, leading to remote code execution.