diff --git a/extensions/browser/src/record-shared.ts b/extensions/browser/src/record-shared.ts
index fab9276ca88..868e3e34bba 100644
--- a/extensions/browser/src/record-shared.ts
+++ b/extensions/browser/src/record-shared.ts
@@ -5,3 +5,7 @@ export function isRecord(value: unknown): value is Record<string, unknown> {
 export function asRecord(value: unknown): Record<string, unknown> | null {
   return isRecord(value) ? value : null;
 }
+
+export function hasNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
diff --git a/extensions/browser/src/security-audit.ts b/extensions/browser/src/security-audit.ts
index 5ee3c5ae614..a91537c37ca 100644
--- a/extensions/browser/src/security-audit.ts
+++ b/extensions/browser/src/security-audit.ts
@@ -4,6 +4,7 @@ import { formatCliCommand } from "openclaw/plugin-sdk/setup-tools";
 import { isPrivateNetworkOptInEnabled, isPrivateIpAddress } from "openclaw/plugin-sdk/ssrf-policy";
 import { redactCdpUrl, resolveBrowserConfig, resolveProfile } from "./browser/config.js";
 import { resolveBrowserControlAuth } from "./browser/control-auth.js";
+import { hasNonEmptyString } from "./record-shared.js";
 
 const BLOCKED_HOSTNAMES = new Set([
   "localhost",
@@ -11,10 +12,6 @@ const BLOCKED_HOSTNAMES = new Set([
   "metadata.google.internal",
 ]);
 
-function hasNonEmptyString(value: unknown): boolean {
-  return typeof value === "string" && value.trim().length > 0;
-}
-
 function isTrustedPrivateHostname(hostname: string): boolean {
   const normalized = hostname.trim().toLowerCase();
   return normalized.length > 0 && BLOCKED_HOSTNAMES.has(normalized);