Skip to content

fix: add security_risk and summary to tool examples for non-native function calling #2251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xingyaoww merged 10 commits into from
Mar 10, 2026
+72 −48
Merged

fix: add security_risk and summary to tool examples for non-native function calling #2251

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
975265e
fix: add security_risk and summary to tool examples for non-native fu…
openhands-agent Mar 1, 2026
c653bd5
Merge branch 'main' into fix/add-security-risk-to-tool-examples
ixchio Mar 2, 2026
26b42c0
Merge branch 'main' into fix/add-security-risk-to-tool-examples
ixchio Mar 3, 2026
4263811
Merge remote-tracking branch 'fork/fix/add-security-risk-to-tool-exam…
openhands-agent Mar 3, 2026
037ba93
fix: add security_risk to task_tracker examples and message to finish…
openhands-agent Mar 3, 2026
f707da6
Merge branch 'main' into fix/add-security-risk-to-tool-examples
ixchio Mar 5, 2026
e22c88e
Merge branch 'main' into fix/add-security-risk-to-tool-examples
ixchio Mar 5, 2026
fc05839
Merge branch 'main' into fix/add-security-risk-to-tool-examples
ixchio Mar 6, 2026
438fe15
Merge branch 'main' into fix/add-security-risk-to-tool-examples
ixchio Mar 8, 2026
a740aa9
Merge branch 'main' into fix/add-security-risk-to-tool-examples
xingyaoww Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 30 additions & 24 deletions openhands-sdk/openhands/sdk/agent/prompts/in_context_learning_example.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@ USER: Create a list of numbers from 1 to 10, and display them in a web page at p

A: Sure! Let me first check the current directory:
<function=terminal>
<parameter=command>
pwd && ls
</parameter>
<parameter=command>pwd && ls</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Check current directory and list files</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -31,16 +31,18 @@ def index():
if __name__ == '__main__':
app.run(port=5000)
</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Create Flask app.py with table display endpoint</parameter>
</function>

USER: EXECUTION RESULT of [str_replace_editor]:
File created successfully at: /workspace/app.py

A: I have created a Python file `app.py` that will display a list of numbers from 1 to 10 when you run it. Let me run the Python file for you:
<function=terminal>
<parameter=command>
python3 app.py > server.log 2>&1 &
</parameter>
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Start Flask server in background</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -49,9 +51,9 @@ USER: EXECUTION RESULT of [terminal]:

A: Looks like the server is running with PID 121 then crashed. Let me check the server log:
<function=terminal>
<parameter=command>
cat server.log
</parameter>
<parameter=command>cat server.log</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Read server log to diagnose crash</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -62,9 +64,9 @@ ModuleNotFoundError: No module named 'flask'

A: Looks like the server crashed because the `flask` module is not installed. Let me install the `flask` module for you:
<function=terminal>
<parameter=command>
pip3 install flask
</parameter>
<parameter=command>pip3 install flask</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Install flask package via pip</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -86,9 +88,9 @@ Successfully installed Werkzeug-3.0.2 blinker-1.7.0 click-8.1.7 flask-3.0.3 itsd

A: The `flask` module is installed successfully. Let me run the Python file again:
<function=terminal>
<parameter=command>
python3 app.py > server.log 2>&1 &
</parameter>
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Restart Flask server after installing dependencies</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -97,9 +99,9 @@ USER: EXECUTION RESULT of [terminal]:
A:
Let me check the server log again:
<function=terminal>
<parameter=command>
cat server.log
</parameter>
<parameter=command>cat server.log</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Verify server started successfully</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -117,9 +119,9 @@ USER: Now kill the server, make it display the numbers in a table format.
A:
Sure! Let me stop the server first:
<function=terminal>
<parameter=command>
kill 124
</parameter>
<parameter=command>kill 124</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Stop the Flask server process</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -132,6 +134,8 @@ Now let me display the numbers in a table format:
<parameter=path>/workspace/app.py</parameter>
<parameter=old_str>return '<table>' + ''.join([f'<tr><td>{i}</td></tr>' for i in numbers]) + '</table>'</parameter>
<parameter=new_str>return '<table>' + ''.join([f'<tr><td>{i}</td></tr>' for i in numbers]) + '</table>'</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Update HTML table formatting</parameter>
</function>

USER: EXECUTION RESULT of [str_replace_editor]:
Expand All @@ -149,9 +153,9 @@ Review the changes and make sure they are as expected. Edit the file again if ne
A:
Running the updated file:
<function=terminal>
<parameter=command>
python3 app.py > server.log 2>&1 &
</parameter>
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Start updated Flask server</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -160,6 +164,8 @@ USER: EXECUTION RESULT of [terminal]:
A:
The server is running on port 5000 with PID 126. You can access the list of numbers in a table format by visiting http://127.0.0.1:5000. Let me know if you have any further requests!
<function=finish>
<parameter=message>The task has been completed. The web server is running and displaying numbers 1-10 in a table format at http://127.0.0.1:5000.</parameter>
<parameter=summary>Task complete - Flask server running with table display</parameter>
</function>

--------------------- END OF EXAMPLE ---------------------
Expand Down
66 changes: 42 additions & 24 deletions openhands-sdk/openhands/sdk/llm/mixins/fn_call_converter.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,14 +85,17 @@ def refine_prompt(prompt: str) -> str:
# interface designed in openhands/agenthub/agent/function_calling.py

# Example snippets for each tool
# Note: security_risk and summary parameters are included in examples to ensure
# models learn to provide them when using prompt-based function calling.
# These parameters are always added to tool schemas for security and transparency.
TOOL_EXAMPLES = {
"bash": {
"check_dir": """
ASSISTANT: Sure! Let me first check the current directory:
<function=terminal>
<parameter=command>
pwd && ls
</parameter>
<parameter=command>pwd && ls</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Check current directory and list files</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -103,9 +106,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
Let me run the Python file for you:
<function=terminal>
<parameter=command>
python3 app.py > server.log 2>&1 &
</parameter>
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Start Flask server in background</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -115,9 +118,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
Looks like the server was running with PID 121 then crashed. Let me check the server log:
<function=terminal>
<parameter=command>
cat server.log
</parameter>
<parameter=command>cat server.log</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Read server log to diagnose crash</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -129,9 +132,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
Looks like the server crashed because the `flask` module is not installed. Let me install the `flask` module for you:
<function=terminal>
<parameter=command>
pip3 install flask
</parameter>
<parameter=command>pip3 install flask</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Install flask package via pip</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -154,9 +157,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
The `flask` module is installed successfully. Let me run the Python file again:
<function=terminal>
<parameter=command>
python3 app.py > server.log 2>&1 &
</parameter>
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Restart Flask server after installing dependencies</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -165,9 +168,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
Let me check the server log again:
<function=terminal>
<parameter=command>
cat server.log
</parameter>
<parameter=command>cat server.log</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Verify server started successfully</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -186,9 +189,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
Sure! Let me stop the server first:
<function=terminal>
<parameter=command>
kill 124
</parameter>
<parameter=command>kill 124</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Stop the Flask server process</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand All @@ -198,9 +201,9 @@ def refine_prompt(prompt: str) -> str:
ASSISTANT:
Running the updated file:
<function=terminal>
<parameter=command>
python3 app.py > server.log 2>&1 &
</parameter>
<parameter=command>python3 app.py > server.log 2>&1 &</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Start updated Flask server</parameter>
</function>

USER: EXECUTION RESULT of [terminal]:
Expand Down Expand Up @@ -229,6 +232,8 @@ def index():
if __name__ == '__main__':
app.run(port=5000)
</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Create Flask app.py with number list endpoint</parameter>
</function>

USER: EXECUTION RESULT of [str_replace_editor]:
Expand All @@ -242,6 +247,8 @@ def index():
<parameter=path>/workspace/app.py</parameter>
<parameter=old_str>return str(numbers)</parameter>
<parameter=new_str>return '<table>' + ''.join([f'<tr><td>{i}</td></tr>' for i in numbers]) + '</table>'</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Update return statement to render HTML table</parameter>
</function>

USER: EXECUTION RESULT of [str_replace_editor]:
Expand All @@ -267,6 +274,8 @@ def index():
goto('http://127.0.0.1:5000')
noop(1000) # Wait for page to load
</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Navigate to localhost to verify page display</parameter>
</function>

USER: EXECUTION RESULT of [browser]:
Expand All @@ -292,6 +301,8 @@ def index():
if __name__ == '__main__':
app.run(port=5000)
</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Create Flask app.py with number list endpoint</parameter>
</function>

USER: EXECUTION RESULT of [edit_file]:
Expand All @@ -310,6 +321,8 @@ def index():
# ... existing code ...
if __name__ == '__main__':
</parameter>
<parameter=security_risk>MEDIUM</parameter>
<parameter=summary>Update index function to render HTML table</parameter>
</function>

USER: EXECUTION RESULT of [edit_file]:
Expand All @@ -331,6 +344,7 @@ def index():
The server is running on port 5000 with PID 126. You can access the list of numbers in a table format by visiting http://127.0.0.1:5000. Let me know if you have any further requests!
<function=finish>
<parameter=message>The task has been completed. The web server is running and displaying numbers 1-10 in a table format at http://127.0.0.1:5000.</parameter>
<parameter=summary>Task complete - Flask server running with table display</parameter>
</function>
""" # noqa: E501
},
Expand All @@ -340,6 +354,8 @@ def index():
Let me check the current task list first:
<function=task_tracker>
<parameter=command>view</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>View current task list status</parameter>
</function>
""",
"plan": """
Expand All @@ -360,6 +376,8 @@ def index():
}
]
</parameter>
<parameter=security_risk>LOW</parameter>
<parameter=summary>Update task plan with current progress</parameter>
</function>
""",
},
Expand Down
Loading