← All skills
verify-sdk
67 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By OpenHands/software-agent-sdk (GitHub) · security · 1,380 stars · scanned at commit 7c97e26
This skill should be used to "verify SDK behavior", "check an SDK change against the feature map", "run the SDK feature map", "maintain the SDK feature map", or "run the daily SDK map pass". It holds the maintained map of what the OpenHands SDK does in-process (agent loop, LLMs, conversations, events, condensers, skills, plugins, MCP, hooks, sub-agents, critic, security, tools, workspaces, settings, observability, ACP), the control-sdk driver its recipes use, and sdk-map (check, owners, baselin…
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 50 places.
Show 17 more
- .agents/skills/verify-sdk/programs/S04/lifecycle.py, line 71
subprocess.run(["tmux", "-S", str(p), "ls"], capture_output=True).returncode - .agents/skills/verify-sdk/programs/S07/public.py, line 33
subprocess.run( - .agents/skills/verify-sdk/programs/S07/public.py, line 67
subprocess.run(["git", "init", "-q", "-b", "main", str(ext)], check=True) - .agents/skills/verify-sdk/programs/S07/public.py, line 109
out["origin"] = subprocess.run( - .agents/skills/verify-sdk/programs/S07/sources.py, line 56
subprocess.run(["git", "init", "-q", str(repo)], check=True) - .agents/skills/verify-sdk/programs/S08/build.py, line 174
subprocess.run( - .agents/skills/verify-sdk/programs/S08/build.py, line 189
subprocess.run(["git", "init", "-q", "-b", "main", str(root)], check=True) - .agents/skills/verify-sdk/programs/S08/build.py, line 198
subprocess.run( - .agents/skills/verify-sdk/programs/S08/build.py, line 212
subprocess.run( - .agents/skills/verify-sdk/programs/S08/build.py, line 228
return subprocess.run( - .agents/skills/verify-sdk/programs/S08/build.py, line 237
return subprocess.run( - .agents/skills/verify-sdk/programs/S09/client.py, line 47
started: list[subprocess.Popen] = [] - .agents/skills/verify-sdk/programs/S09/client.py, line 56
def start(transport: str, port: int, *extra: str, env=None) -> subprocess.Popen: - .agents/skills/verify-sdk/programs/S09/client.py, line 57
proc = subprocess.Popen( - .agents/skills/verify-sdk/programs/S09/client.py, line 59
stdout=subprocess.DEVNULL, - .agents/skills/verify-sdk/programs/S09/client.py, line 60
stderr=subprocess.DEVNULL, - .agents/skills/verify-sdk/programs/S10/marketplace/plugins/attached-hooks/hooks/hooks.json, line 4
{"matcher": "*", "hooks": [{"type": "command", "command": "echo attached >> order.log", "timeout": 5}]}
and 30 more places
Downloads and installs other software
The author does not mention this.
Found in 31 places.
Show 17 more
- .agents/skills/verify-sdk/programs/S18/cloud_local.py, line 43
"stdio_servers": [{"name": "fs", "command": "npx", "args": ["fs-server"]}], - .agents/skills/verify-sdk/programs/S18/remote_workspace.py, line 196
"fetch": {"command": "uvx", "args": ["mcp-server-fetch"]} - .agents/skills/verify-sdk/programs/S19/agent_profiles.py, line 69
"github": MCPServer(command="uvx", args=["mcp-server-github"]), - .agents/skills/verify-sdk/programs/S19/agent_profiles.py, line 70
"fetch": MCPServer(command="uvx", args=["mcp-server-fetch"]), - .agents/skills/verify-sdk/programs/S19/agent_settings.py, line 66
"command": "uvx", - .agents/skills/verify-sdk/programs/S19/agent_settings.py, line 74
"off": {"command": "uvx", "args": ["mcp-server-fetch"], "enabled": False}, - .agents/skills/verify-sdk/programs/S19/agent_settings.py, line 432
"fetch": {"command": "uvx", "args": ["mcp-server-fetch"]} - .agents/skills/verify-sdk/programs/S21/acp_conversation.py, line 128
"command": "uvx", - .agents/skills/verify-sdk/references/feature-map/README.md, line 53
(`llm`, `tmux`, `git`, `node`, `uvx`, `docker`, `apptainer`, `chromium`, - .agents/skills/verify-sdk/references/feature-map/S04-local-conversation.md, line 7
Needs: `llm`, `tmux`, `network`, `uvx` - .agents/skills/verify-sdk/references/feature-map/S04-local-conversation.md, line 56
- Live bullets: `DEEPSEEK_API_KEY` exported. Example 10 also needs `uvx` and outbound network (it starts `mcp-server-fetch`). - .agents/skills/verify-sdk/references/feature-map/S04-local-conversation.md, line 276
- **Examples 09, 10, 11 and 12 (`S04.pause`, `S04.persist-events`, `S04.resume`, `S04.async-callback`, `S04.secrets-update`, `S04.secrets-masking`, `S04.visuali - .agents/skills/verify-sdk/references/feature-map/S04-local-conversation.md, line 304
- `10_persistence.py` and `14_context_condenser.py` write `./.conversations` relative to the current directory; reruns pile up conversation folders there. Examp - .agents/skills/verify-sdk/references/feature-map/S08-plugins-marketplace.md, line 7
Needs: `llm` (example demo 1 and real-LLM test), `git`, `network` (GitHub sources), `uvx` (the example plugin's `fetch` MCP server) - .agents/skills/verify-sdk/references/feature-map/S08-plugins-marketplace.md, line 49
- Live bullets need `DEEPSEEK_API_KEY`. Example 02 also needs network for `github:anthropics/skills`, and `uvx` for the `code-quality` plugin's `fetch` server. - .agents/skills/verify-sdk/references/feature-map/S08-plugins-marketplace.md, line 324
- The `code-quality` example plugin's `.mcp.json` starts `uvx mcp-server-fetch` and its `PostToolUse` hook appends to `$OPENHANDS_PROJECT_DIR/.hook_log`; instal - .agents/skills/verify-sdk/references/feature-map/S09-mcp.md, line 7
Needs: `llm` (examples), `uvx` and `node` (example 07's `fetch` and `repomix` servers), `network` (example 07 reads GitHub, example 08 reaches Notion)
and 11 more places
Sends data to these websites: registry.npmjs.org
The author does not mention this. Expected for a security skill.
Found in 14 places.
Show 11 more
- .agents/skills/verify-sdk/programs/S14/terminal.py, line 67
f"print('status', u.urlopen('http://127.0.0.1:{port}/').status)\"" - .agents/skills/verify-sdk/programs/S18/cloud_local.py, line 122
except httpx.HTTPStatusError as exc: - .agents/skills/verify-sdk/programs/S18/cloud_local.py, line 134
info = httpx.get( - .agents/skills/verify-sdk/programs/S18/remote_workspace.py, line 183
admin = httpx.Client(base_url=server.base_url, headers={"X-Session-API-Key": KEY}) - .agents/skills/verify-sdk/programs/S18/servers.py, line 67
if httpx.get(f"{self.base_url}/health", timeout=1).status_code == 200: - .agents/skills/verify-sdk/programs/S18/servers.py, line 69
except httpx.HTTPError: - .agents/skills/verify-sdk/programs/S19/acp_catalog.py, line 84
with httpx.Client(timeout=20) as client: - .agents/skills/verify-sdk/programs/S19/acp_catalog.py, line 93
except httpx.HTTPError as exc: - .agents/skills/verify-sdk/programs/S21/live_handshake.py, line 14
import urllib.request - .agents/skills/verify-sdk/programs/S21/live_handshake.py, line 25
urllib.request.urlopen("https://registry.npmjs.org/-/ping", timeout=10).read() - .agents/skills/verify-sdk/references/feature-map/S08-plugins-marketplace.md, line 37
- `openhands.sdk.plugin`: `Plugin.load(path)`, `Plugin.load_all(dir)`, `Plugin.fetch(source, ref=, repo_path=)`, `fetch_plugin_with_resolution`, `plugin.add_ski
Changes files outside its own folder
The author does not mention this.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'verify-sdk' ] || [ -L ~/.agents/skills/'verify-sdk' ]; then echo 'A skill folder named verify-sdk already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/OpenHands/software-agent-sdk' "$d" && git -C "$d" checkout --quiet '7c97e26f3e4a04edf1c247680d8dca57007885ae' -- '.agents/skills/verify-sdk' && mkdir -p ~/.agents/skills && cp -R "$d"/'.agents/skills/verify-sdk' ~/.agents/skills/'verify-sdk' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'verify-sdk' ~/.claude/skills/'verify-sdk' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for OpenHands/software-agent-sdk shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/OpenHands/software-agent-sdk/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | 7c97e26 | 67 |