Virtuoso Skill

Cadence Virtuoso Skill语言开发辅助工具，包含API查询、代码校验、智能补全功能。使用场景：(1) 编写/调试Virtuoso Skill代码；(2) 检查API调用是否合法；(3) 查询Skill函数的用法和参数；(4) 避免API幻觉和未定义函数调用。

Security Scan

The skill appears to implement exactly the described Virtuoso Skill API lookup, linting and chatbot features, but there are a few unexpected/odd items (a unicode-control-chars prompt-injection signal in SKILL.md and a hard-coded absolute input path in a helper script) that warrant caution before running anything.

Purpose & Capability

Name/description match the bundled assets: a local API database, a chatbot (skill_chatbot.py), and a linter (skill_lint.py). The files and references to Cadence/Virtuoso APIs are coherent with the stated purpose. However, scripts include a hard-coded absolute path (/root/.openclaw/qqbot/downloads/...) in extract_functions.py which is unnecessary for normal usage and looks like a leftover from the developer environment.

Instruction Scope

SKILL.md only instructs running the included scripts and optionally starting a local web server — actions that match purpose (searching and linting APIs). The runtime instructions do not request remote endpoints, credentials, or broad system access. Still: the scripts will read files from disk (the database files under references and any code directories you lint). The hard-coded path in extract_functions.py could cause the script to read an unexpected file if run without modification.

Install Mechanism

No install spec — instruction-only with bundled scripts and local JSON/GZ database files. This is low-risk compared to downloads/installers. The large compressed DB is included in the repo rather than fetched from the network.

Credentials

The skill declares no environment variables or credentials, which fits its offline/local utility. However, the tools intentionally read local files and directories (for linting and loading database files). This is expected for a linter/lookup tool but means the scripts can access any file paths you point them at. The unexpected absolute path in extract_functions.py is disproportionate and may attempt to read a local download from a specific user account if executed as-is.

Persistence & Privilege

always:false, user-invocable:true — normal. The skill does not request persistent platform-level privileges. It can run a web server (Flask) if you start it, which exposes a local HTTP interface; consider network exposure risk if run on a server.

Scan Findings in Context

[unicode-control-chars] unexpected: The SKILL.md pre-scan flagged unicode control characters. These can be used to obfuscate or alter how text appears to an LLM or to hide content; they are not expected for a normal developer-facing README/instruction file. Inspect the raw SKILL.md bytes before trusting automated parsing or evaluation.

What to consider before installing

This skill is largely coherent with its stated purpose (local API database + chatbot + linter). Before running anything: (1) Inspect SKILL.md raw bytes for hidden control characters (the scanner flagged unicode-control-chars). (2) Open the scripts and remove or modify any hard-coded absolute paths (extract_functions.py references /root/.openclaw/qqbot/downloads/...) — do not run scripts that read unexpected absolute locations. (3) If you run the web mode (Flask), run it on a safe host and bind to localhost if you don't want remote access. (4) Because the tool reads files you point it at, only lint code or directories you trust. (5) If you plan to use this in automation, prefer to run it in a restricted environment (container/VM) and audit any file I/O first. If you want, I can show the exact lines with the absolute path and the SKILL.md bytes that contain control characters to help you inspect/clean them.

Virtuoso Skill开发辅助工具

本工具提供Virtuoso Skill开发的全流程支持，从根源解决API幻觉问题。

功能特性

1. 🤖 智能API推荐（新增）

根据你的自然语言描述，自动推荐最合适的Skill函数！

• 输入"我想打开单元视图"，直接告诉你应该用 dbOpenCellView
• 输入"创建版图矩形"，推荐 leCreateRect
• 支持模糊匹配，即使描述不准确也能找到相关函数
• 提供完整的语法、参数说明和示例代码

2. 🔍 API校验（核心功能）

自动检查Skill代码中的函数调用是否合法：

• 识别未定义的函数调用
• 检查参数数量是否正确
• 提示参数类型不匹配问题
• 给出错误原因和修复建议

3. 📚 API查询

支持按关键词搜索Skill函数：

• 函数功能描述
• 完整语法和参数说明
• 示例代码
• 注意事项和常见问题

使用方法

智能API推荐（聊天机器人）

交互模式（推荐日常使用）

skill_chatbot.py

进入交互式查询，你可以直接输入自然语言描述：

您> 我想要打开一个单元视图
根据您的描述，找到以下最匹配的Skill API：
[显示dbOpenCellView完整信息]

直接查询

skill_chatbot.py --query "打开单元视图"
skill_chatbot.py -q "创建版图矩形"

启动Web图形界面

skill_chatbot.py --web --port 8080

然后在浏览器打开 http://your-server:8080 即可使用图形化界面查询。

API代码校验

检查单个Skill文件

skill_lint.py --file your_code.il

检查整个目录下的Skill文件

skill_lint.py --dir ./your_project/

检查代码片段

skill_lint.py --code "(dbOpenCellView \"mylib\" \"mycell\" \"schematic\" \"r\")"

列出所有支持的函数

skill_lint.py --list-functions

API覆盖范围

当前包含312个常用Skill API，覆盖：

• 基础函数（字符串、列表、文件操作等）
• 数据库操作API（db* 系列函数）
• 版图操作API（le*、ge* 系列函数）
• 原理图操作API（sch* 系列函数）
• 界面操作API（hi* 系列函数）

开发规范

1. 必须使用已定义的API：禁止使用任何不在API数据库中的函数
2. 参数必须匹配：严格按照文档提供参数数量和类型
3. 提交前必须检查：所有Skill代码提交前必须通过skill_lint.py检查
4. 遇到未定义API：请反馈到技术团队，不要自行编造

错误示例与修复

❌ 错误示例：

; 错误：使用了未定义的函数 dbOpenCell
(dbOpenCell "mylib" "mycell" "r")

; 错误：参数数量不足
(dbOpenCellView "mylib" "mycell" "schematic")

✅ 正确示例：

; 正确：使用合法的API并提供完整参数
(dbOpenCellView "mylib" "mycell" "schematic" "r")

更新说明

API数据库会持续更新，支持更多函数和功能。如有API缺失或错误，请及时反馈。