📄 skills/ssh.md（前 20 行）

---
name: SSH Microagent
type: knowledge
version: 1.0.0
agent: CodeActAgent
triggers:
  - ssh
  - remote server
  - remote machine
---

# SSH Microagent

This microagent provides capabilities for
establishing and managing SSH connections...

📄 skill_loader.py（第 1-7 行）

"""Utilities for loading skills for V1 conversations.

This module provides functions to load skills from the agent-server,
which centralizes all skill loading logic. The app-server acts as a
thin proxy that:
1. Builds the org_config with authentication information
2. Builds the sandbox_config with exposed URLs
3. Calls the agent-server's /api/skills endpoint

All source-specific skill loading is handled by the agent-server."""

📄 skill_loader.py（第 618-640 行）

async def load_skills_from_agent_server(
    agent_server_url: str,
    session_api_key: str | None,
    project_dir: str,
    org_configs: list[OrgConfig] | None = None,
    sandbox_config: SandboxConfig | None = None,
    load_public: bool = True,
    load_user: bool = True,
    load_project: bool = True,
    load_org: bool = True,
    registered_marketplaces: list[MarketplaceRegistration] | None = None,
) -> list[Skill]:
    """Load all skills from the agent-server."""
    payload = {
        'load_public': load_public,
        'load_user': load_user,
        'load_project': load_project,
        'load_org': load_org,
        'project_dir': project_dir,
        'org_configs': [c.model_dump() for c in org_configs] if org_configs else None,
        'org_config': org_configs[0].model_dump() if org_configs else None,
        'sandbox_config': sandbox_config.model_dump() if sandbox_config else None,
    }

📄 skill_loader.py（第 196-216 行）

def _candidate_repo_paths(provider: ProviderType, owner: str) -> list[str]:
    """Return the global skill-repo paths for an owner."""
    if provider == ProviderType.GITLAB:
        return [f'{owner}/openhands-config']
    if provider == ProviderType.AZURE_DEVOPS:
        return [f'{owner}/openhands-config/openhands-config']
    return [f'{owner}/.openhands', f'{owner}/.agents']

📄 skill_loader.py（第 220-223 行）

# Upper bound on how many global skill repos we will verify
_MAX_ORG_CANDIDATES = 30
_URL_RESOLVE_CONCURRENCY = 8

📄 skill_loader.py（第 503-520 行）

async def authenticate_marketplace_sources(
    registered_marketplaces: list[MarketplaceRegistration] | None,
    user_context: UserContext,
) -> list[MarketplaceRegistration] | None:
    """Swap auto-load marketplace sources for authenticated git URLs.

    The agent-server clones auto_load marketplace registrations itself
    but has no provider credentials, so private repositories fail to
    clone (and a bare owner/repo source is misread as a nonexistent
    local path). Resolve each such source to an authenticated URL via
    the user's provider tokens and return copies with source replaced."""

📄 skills_router.py（第 135-183 行）

GLOBAL_SKILLS_DIR = Path(openhands.__file__).parent.parent / 'skills'
USER_SKILLS_DIR = Path.home() / '.openhands' / 'microagents'

@router.get('/search', response_model=SkillPage)
async def search_skills(
    page_id: str | None = None,
    limit: int = 100,
) -> SkillPage:
    """Search / list available global and user-level skills."""
    skills = []
    skills.extend(_load_skills_from_dir(GLOBAL_SKILLS_DIR, 'global'))
    skills.extend(_load_skills_from_dir(USER_SKILLS_DIR, 'user'))
    skills.sort(key=lambda s: (s.source, s.name))
    # cursor-based pagination
    page = skills[start : start + limit]
    next_page_id = page[-1].name if len(page) == limit else None
    return SkillPage(items=page, next_page_id=next_page_id)

📄 skills_router.py（第 200-280 行）

async def _clone_marketplace_repo(
    marketplace: MarketplaceRegistration,
    user_context: UserContext,
) -> tuple[Path | None, str]:
    # ... clone logic with security checks ...
    
    # Run git without a shell (argv form) and use -- so a source/ref
    # that begins with '-' can never be parsed as a git option
    # (argument injection). Reject leading-'-' values outright.
    if clone_url.startswith('-'):
        _cleanup_clone_dir(clone_dir)
        return None, f'Invalid clone URL: {clone_url}'
    
    result = subprocess.run(
        ['git', 'clone', '--', clone_url, str(clone_dir)],
        capture_output=True, text=True, timeout=120,
    )

📄 skill_loader.py（第 708-734 行）

def _convert_skill_info_to_skill(skill_info: SkillInfo) -> Skill:
    trigger: TaskTrigger | KeywordTrigger | None = None

    if skill_info.triggers:
        if any(t.startswith('/') for t in skill_info.triggers):
            trigger = TaskTrigger(triggers=skill_info.triggers)
        else:
            trigger = KeywordTrigger(keywords=skill_info.triggers)

    return Skill(
        name=skill_info.name,
        content=skill_info.content,
        trigger=trigger,
        source=skill_info.source,
        description=skill_info.description,
        is_agentskills_format=skill_info.is_agentskills_format,
    )

📄 skills/ 目录内容

add_agent.md          azure_devops.md      github.md
add_repo_inst.md      bitbucket_data_center.md  gitlab.md
address_pr_comments.md  bitbucket.md          kubernetes.md
agent-builder.md      code-review.md         npm.md
agent_memory.md       codereview-roasted.md  onboarding.md
default-tools.md      docker.md             pdflatex.md
fix-py-line-too-long.md  fix_test.md         security.md
flarglebargle.md      flarglebargle.md       ssh.md
swift-linux.md        update_pr_description.md  update_test.md