Skip to content

Commit 975265e

Browse files
openhands-agentopenhands-agent
committed
fix: add security_risk and summary to tool examples for non-native function calling
This fixes issue #2175 where models using prompt-based function calling (native_tool_calling=False) would fail to provide the security_risk parameter because the examples in the system prompt didn't show it. Changes: - Add security_risk parameter to all tool examples in TOOL_EXAMPLES dict - Add summary parameter to all tool examples for transparency - Update in_context_learning_example.j2 template with the same parameters The security_risk parameter is required when LLMSecurityAnalyzer is active, and the summary parameter is always recommended for action transparency. Fixes: #2175 Co-authored-by: openhands <openhands@all-hands.dev>
1 parent fe9b8ff commit 975265e

File tree

2 files changed

+69
-48
lines changed

2 files changed

+69
-48
lines changed

‎openhands-sdk/openhands/sdk/agent/prompts/in_context_learning_example.j2‎

Lines changed: 29 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ USER: Create a list of numbers from 1 to 10, and display them in a web page at p
66

77
A: Sure! Let me first check the current directory:
88
<function=terminal>
9-
<parameter=command>
10-
pwd && ls
11-
</parameter>
9+
<parameter=command>pwd && ls</parameter>
10+
<parameter=security_risk>LOW</parameter>
11+
<parameter=summary>Check current directory and list files</parameter>
1212
</function>
1313

1414
USER: EXECUTION RESULT of [terminal]:
@@ -31,16 +31,18 @@ def index():
3131
if __name__ == '__main__':
3232
app.run(port=5000)
3333
</parameter>
34+
<parameter=security_risk>MEDIUM</parameter>
35+
<parameter=summary>Create Flask app.py with table display endpoint</parameter>
3436
</function>
3537

3638
USER: EXECUTION RESULT of [str_replace_editor]:
3739
File created successfully at: /workspace/app.py
3840

3941
A: I have created a Python file `app.py` that will display a list of numbers from 1 to 10 when you run it. Let me run the Python file for you:
4042
<function=terminal>
41-
<parameter=command>
42-
python3 app.py > server.log 2>&1 &
43-
</parameter>
43+
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
44+
<parameter=security_risk>MEDIUM</parameter>
45+
<parameter=summary>Start Flask server in background</parameter>
4446
</function>
4547

4648
USER: EXECUTION RESULT of [terminal]:
@@ -49,9 +51,9 @@ USER: EXECUTION RESULT of [terminal]:
4951

5052
A: Looks like the server is running with PID 121 then crashed. Let me check the server log:
5153
<function=terminal>
52-
<parameter=command>
53-
cat server.log
54-
</parameter>
54+
<parameter=command>cat server.log</parameter>
55+
<parameter=security_risk>LOW</parameter>
56+
<parameter=summary>Read server log to diagnose crash</parameter>
5557
</function>
5658

5759
USER: EXECUTION RESULT of [terminal]:
@@ -62,9 +64,9 @@ ModuleNotFoundError: No module named 'flask'
6264

6365
A: Looks like the server crashed because the `flask` module is not installed. Let me install the `flask` module for you:
6466
<function=terminal>
65-
<parameter=command>
66-
pip3 install flask
67-
</parameter>
67+
<parameter=command>pip3 install flask</parameter>
68+
<parameter=security_risk>MEDIUM</parameter>
69+
<parameter=summary>Install flask package via pip</parameter>
6870
</function>
6971

7072
USER: EXECUTION RESULT of [terminal]:
@@ -86,9 +88,9 @@ Successfully installed Werkzeug-3.0.2 blinker-1.7.0 click-8.1.7 flask-3.0.3 itsd
8688

8789
A: The `flask` module is installed successfully. Let me run the Python file again:
8890
<function=terminal>
89-
<parameter=command>
90-
python3 app.py > server.log 2>&1 &
91-
</parameter>
91+
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
92+
<parameter=security_risk>MEDIUM</parameter>
93+
<parameter=summary>Restart Flask server after installing dependencies</parameter>
9294
</function>
9395

9496
USER: EXECUTION RESULT of [terminal]:
@@ -97,9 +99,9 @@ USER: EXECUTION RESULT of [terminal]:
9799
A:
98100
Let me check the server log again:
99101
<function=terminal>
100-
<parameter=command>
101-
cat server.log
102-
</parameter>
102+
<parameter=command>cat server.log</parameter>
103+
<parameter=security_risk>LOW</parameter>
104+
<parameter=summary>Verify server started successfully</parameter>
103105
</function>
104106

105107
USER: EXECUTION RESULT of [terminal]:
@@ -117,9 +119,9 @@ USER: Now kill the server, make it display the numbers in a table format.
117119
A:
118120
Sure! Let me stop the server first:
119121
<function=terminal>
120-
<parameter=command>
121-
kill 124
122-
</parameter>
122+
<parameter=command>kill 124</parameter>
123+
<parameter=security_risk>MEDIUM</parameter>
124+
<parameter=summary>Stop the Flask server process</parameter>
123125
</function>
124126

125127
USER: EXECUTION RESULT of [terminal]:
@@ -132,6 +134,8 @@ Now let me display the numbers in a table format:
132134
<parameter=path>/workspace/app.py</parameter>
133135
<parameter=old_str>return '<table>' + ''.join([f'<tr><td>{i}</td></tr>' for i in numbers]) + '</table>'</parameter>
134136
<parameter=new_str>return '<table>' + ''.join([f'<tr><td>{i}</td></tr>' for i in numbers]) + '</table>'</parameter>
137+
<parameter=security_risk>MEDIUM</parameter>
138+
<parameter=summary>Update HTML table formatting</parameter>
135139
</function>
136140

137141
USER: EXECUTION RESULT of [str_replace_editor]:
@@ -149,9 +153,9 @@ Review the changes and make sure they are as expected. Edit the file again if ne
149153
A:
150154
Running the updated file:
151155
<function=terminal>
152-
<parameter=command>
153-
python3 app.py > server.log 2>&1 &
154-
</parameter>
156+
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
157+
<parameter=security_risk>MEDIUM</parameter>
158+
<parameter=summary>Start updated Flask server</parameter>
155159
</function>
156160

157161
USER: EXECUTION RESULT of [terminal]:
@@ -160,6 +164,7 @@ USER: EXECUTION RESULT of [terminal]:
160164
A:
161165
The server is running on port 5000 with PID 126. You can access the list of numbers in a table format by visiting http://127.0.0.1:5000. Let me know if you have any further requests!
162166
<function=finish>
167+
<parameter=summary>Task complete - Flask server running with table display</parameter>
163168
</function>
164169

165170
--------------------- END OF EXAMPLE ---------------------

‎openhands-sdk/openhands/sdk/llm/mixins/fn_call_converter.py‎

Lines changed: 40 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -85,14 +85,17 @@ def refine_prompt(prompt: str) -> str:
8585
# interface designed in openhands/agenthub/agent/function_calling.py
8686

8787
# Example snippets for each tool
88+
# Note: security_risk and summary parameters are included in examples to ensure
89+
# models learn to provide them when using prompt-based function calling.
90+
# These parameters are always added to tool schemas for security and transparency.
8891
TOOL_EXAMPLES = {
8992
"bash": {
9093
"check_dir": """
9194
ASSISTANT: Sure! Let me first check the current directory:
9295
<function=terminal>
93-
<parameter=command>
94-
pwd && ls
95-
</parameter>
96+
<parameter=command>pwd && ls</parameter>
97+
<parameter=security_risk>LOW</parameter>
98+
<parameter=summary>Check current directory and list files</parameter>
9699
</function>
97100
98101
USER: EXECUTION RESULT of [terminal]:
@@ -103,9 +106,9 @@ def refine_prompt(prompt: str) -> str:
103106
ASSISTANT:
104107
Let me run the Python file for you:
105108
<function=terminal>
106-
<parameter=command>
107-
python3 app.py > server.log 2>&1 &
108-
</parameter>
109+
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
110+
<parameter=security_risk>MEDIUM</parameter>
111+
<parameter=summary>Start Flask server in background</parameter>
109112
</function>
110113
111114
USER: EXECUTION RESULT of [terminal]:
@@ -115,9 +118,9 @@ def refine_prompt(prompt: str) -> str:
115118
ASSISTANT:
116119
Looks like the server was running with PID 121 then crashed. Let me check the server log:
117120
<function=terminal>
118-
<parameter=command>
119-
cat server.log
120-
</parameter>
121+
<parameter=command>cat server.log</parameter>
122+
<parameter=security_risk>LOW</parameter>
123+
<parameter=summary>Read server log to diagnose crash</parameter>
121124
</function>
122125
123126
USER: EXECUTION RESULT of [terminal]:
@@ -129,9 +132,9 @@ def refine_prompt(prompt: str) -> str:
129132
ASSISTANT:
130133
Looks like the server crashed because the `flask` module is not installed. Let me install the `flask` module for you:
131134
<function=terminal>
132-
<parameter=command>
133-
pip3 install flask
134-
</parameter>
135+
<parameter=command>pip3 install flask</parameter>
136+
<parameter=security_risk>MEDIUM</parameter>
137+
<parameter=summary>Install flask package via pip</parameter>
135138
</function>
136139
137140
USER: EXECUTION RESULT of [terminal]:
@@ -154,9 +157,9 @@ def refine_prompt(prompt: str) -> str:
154157
ASSISTANT:
155158
The `flask` module is installed successfully. Let me run the Python file again:
156159
<function=terminal>
157-
<parameter=command>
158-
python3 app.py > server.log 2>&1 &
159-
</parameter>
160+
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
161+
<parameter=security_risk>MEDIUM</parameter>
162+
<parameter=summary>Restart Flask server after installing dependencies</parameter>
160163
</function>
161164
162165
USER: EXECUTION RESULT of [terminal]:
@@ -165,9 +168,9 @@ def refine_prompt(prompt: str) -> str:
165168
ASSISTANT:
166169
Let me check the server log again:
167170
<function=terminal>
168-
<parameter=command>
169-
cat server.log
170-
</parameter>
171+
<parameter=command>cat server.log</parameter>
172+
<parameter=security_risk>LOW</parameter>
173+
<parameter=summary>Verify server started successfully</parameter>
171174
</function>
172175
173176
USER: EXECUTION RESULT of [terminal]:
@@ -186,9 +189,9 @@ def refine_prompt(prompt: str) -> str:
186189
ASSISTANT:
187190
Sure! Let me stop the server first:
188191
<function=terminal>
189-
<parameter=command>
190-
kill 124
191-
</parameter>
192+
<parameter=command>kill 124</parameter>
193+
<parameter=security_risk>MEDIUM</parameter>
194+
<parameter=summary>Stop the Flask server process</parameter>
192195
</function>
193196
194197
USER: EXECUTION RESULT of [terminal]:
@@ -198,9 +201,9 @@ def refine_prompt(prompt: str) -> str:
198201
ASSISTANT:
199202
Running the updated file:
200203
<function=terminal>
201-
<parameter=command>
202-
python3 app.py > server.log 2>&1 &
203-
</parameter>
204+
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
205+
<parameter=security_risk>MEDIUM</parameter>
206+
<parameter=summary>Start updated Flask server</parameter>
204207
</function>
205208
206209
USER: EXECUTION RESULT of [terminal]:
@@ -229,6 +232,8 @@ def index():
229232
if __name__ == '__main__':
230233
app.run(port=5000)
231234
</parameter>
235+
<parameter=security_risk>MEDIUM</parameter>
236+
<parameter=summary>Create Flask app.py with number list endpoint</parameter>
232237
</function>
233238
234239
USER: EXECUTION RESULT of [str_replace_editor]:
@@ -242,6 +247,8 @@ def index():
242247
<parameter=path>/workspace/app.py</parameter>
243248
<parameter=old_str>return str(numbers)</parameter>
244249
<parameter=new_str>return '<table>' + ''.join([f'<tr><td>{i}</td></tr>' for i in numbers]) + '</table>'</parameter>
250+
<parameter=security_risk>MEDIUM</parameter>
251+
<parameter=summary>Update return statement to render HTML table</parameter>
245252
</function>
246253
247254
USER: EXECUTION RESULT of [str_replace_editor]:
@@ -267,6 +274,8 @@ def index():
267274
goto('http://127.0.0.1:5000')
268275
noop(1000) # Wait for page to load
269276
</parameter>
277+
<parameter=security_risk>LOW</parameter>
278+
<parameter=summary>Navigate to localhost to verify page display</parameter>
270279
</function>
271280
272281
USER: EXECUTION RESULT of [browser]:
@@ -292,6 +301,8 @@ def index():
292301
if __name__ == '__main__':
293302
app.run(port=5000)
294303
</parameter>
304+
<parameter=security_risk>MEDIUM</parameter>
305+
<parameter=summary>Create Flask app.py with number list endpoint</parameter>
295306
</function>
296307
297308
USER: EXECUTION RESULT of [edit_file]:
@@ -310,6 +321,8 @@ def index():
310321
# ... existing code ...
311322
if __name__ == '__main__':
312323
</parameter>
324+
<parameter=security_risk>MEDIUM</parameter>
325+
<parameter=summary>Update index function to render HTML table</parameter>
313326
</function>
314327
315328
USER: EXECUTION RESULT of [edit_file]:
@@ -331,6 +344,7 @@ def index():
331344
The server is running on port 5000 with PID 126. You can access the list of numbers in a table format by visiting http://127.0.0.1:5000. Let me know if you have any further requests!
332345
<function=finish>
333346
<parameter=message>The task has been completed. The web server is running and displaying numbers 1-10 in a table format at http://127.0.0.1:5000.</parameter>
347+
<parameter=summary>Task complete - Flask server running with table display</parameter>
334348
</function>
335349
""" # noqa: E501
336350
},
@@ -340,6 +354,7 @@ def index():
340354
Let me check the current task list first:
341355
<function=task_tracker>
342356
<parameter=command>view</parameter>
357+
<parameter=summary>View current task list status</parameter>
343358
</function>
344359
""",
345360
"plan": """
@@ -360,6 +375,7 @@ def index():
360375
}
361376
]
362377
</parameter>
378+
<parameter=summary>Update task plan with current progress</parameter>
363379
</function>
364380
""",
365381
},

0 commit comments

Comments
 (0)