Skill

verify-openhands

skill:openhands/openhands#verify-openhands

This skill should be used to "verify OpenHands features", "test the Canvas UI like a user", "drive Agent Canvas", "check a UI change in the real app", "create or update the feature map", "run the daily pass" or "run the weekly feature audit". Ships control-openhands (launch, doctor, browser, LLM profiles, conversations, evidence, map tooling, cleanup) and the maintained map of every user-facing feature.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:57 UTC at 6c12007

findings

—

highest severity

threat classes

2,751

files scanned

0/24,364

checks satisfied

package advisories

Why this verdict

suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:b6f3618541e39cc3)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:cd3f56630c4e36e7)
suspicious: floor fact PY-FETCH-EXEC-INSTRUCTED (DET:d028576bde5b2d96)

Security findings 0

No individual findings recorded

The suspicious verdict rests on the coverage gaps below.

Coverage gaps 25057

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

electron/build-resources/icon.icns

context:unanalyzable_binary binary content is only byte-scanned

electron/build-resources/icon.ico

context:unanalyzable_binary binary content is only byte-scanned

public/favicon.ico

unanalyzable_binary binary content is only byte-scanned

.agents/skills/verify-openhands/references/backfills/evidence/network-state-and-refetch.mp4

unanalyzable_binary binary content is only byte-scanned

src/assets/notification.mp3

unanalyzable_binary binary content is only byte-scanned

src/components/features/plugins/plugin-spec-identity.ts

glob_budget_exceeded reference source exceeds 262144 characters

.agents/skills/verify-openhands/references/backfills/2026-10-12-open-bugs.json

glob_budget_exceeded reference source exceeds 262144 characters

.agents/skills/verify-openhands/references/backfills/2026-10-16-main-refresh.json

glob_budget_exceeded reference glob work exceeds its budget

.agents/skills/verify-openhands/references/mapping.md

glob_budget_exceeded reference source exceeds 262144 characters

src/i18n/translation.json

manifest_unparseable yaml: while parsing a flow node

helm/agent-canvas/templates/ingress.yaml

manifest_unparseable yaml: while parsing a flow node

helm/agent-canvas/templates/rbac.yaml

manifest_unparseable yaml: while parsing a flow node

helm/agent-canvas/templates/service.yaml

manifest_unparseable yaml: while parsing a flow node

helm/agent-canvas/templates/serviceaccount.yaml

manifest_unparseable yaml: while parsing a flow node

helm/agent-canvas/templates/statefulset.yaml

parse_error tree-sitter tsx parse has errors; extraction may be partial

__tests__/agent-server-ui-providers.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

__tests__/components/backends/manage-backends-modal.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

__tests__/components/backends/managed-agents-view.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

__tests__/components/features/sidebar/mars-session-panel.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

__tests__/hooks/use-mars-tunnel-backend.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

src/components/conversation-events/chat/task-tracking/task-list-section.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

src/components/features/chat/chat-error-details.test.tsx

parse_error tree-sitter tsx parse has errors; extraction may be partial

src/components/features/settings/agent-canvas-update-card.test.tsx

parse_error tree-sitter typescript parse has errors; extraction may be partial

vitest.setup.ts

no_dataflow_for_dynamic_code line 1068: invoked code is not structurally extracted

.agents/skills/verify-openhands/scripts/browser-daemon.mjs

no_dataflow_for_dynamic_code line 411: invoked code is not structurally extracted

__tests__/vite-config.test.ts

no_dataflow_for_dynamic_code line 12: invoked code is not structurally extracted

.openhands/setup.sh

no_dataflow_for_dynamic_code line 521: invoked code is not structurally extracted

docker/entrypoint.sh

no_dataflow_for_dynamic_code line 62: invoked code is not structurally extracted

docker/smoke-test.sh

no_dataflow_for_dynamic_code line 65: invoked code is not structurally extracted

docker/smoke-test.sh