中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：19 小时前 重新扫描
5 /100
virtuoso-skill
Cadence Virtuoso Skill语言开发辅助工具，包含API查询、代码校验、智能补全功能
This is a legitimate Cadence Virtuoso Skill development assistance tool with no malicious behavior. It provides API validation and querying for EDA software development.
技能名称virtuoso-skill
分析耗时38.1s
引擎pi
✓
可以安装
This skill is safe to use. No security concerns identified.

安全发现 1 项

严重性 安全发现 位置
低危
Hardcoded data source paths in extraction scripts 文档欺骗
Two data extraction scripts (extract_functions.py, parse_api_data.py) reference a hardcoded path /root/.openclaw/qqbot/downloads/ which may indicate data sourcing from another tool. These are utility scripts, not core functionality.
input_path = Path("/root/.openclaw/qqbot/downloads/CadenceSkillAPIFinder_1773394844827.html")
→ Consider using configurable paths or environment variables for data sources
 scripts/extract_functions.py:74
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 skill_chatbot.py:49-66 reads JSON API database files
网络访问 NONE READ ✓ 一致 skill_chatbot.py:175 starts Flask web server on 0.0.0.0 - declared in SKILL.md a…
命令执行 NONE NONE — No subprocess or shell execution found
环境变量 NONE NONE — No environment variable access found
技能调用 NONE NONE — Not applicable to this skill
2 项发现
🔗
中危 外部 URL 外部 URL
http://your-server:8080
SKILL.md:58
🔗
中危 外部 URL 外部 URL
http://0.0.0.0:
scripts/skill_chatbot.py:378

目录结构

6 文件 · 64.6 KB · 1132 行
Python 4f · 1018L Markdown 1f · 113L JSON 1f · 1L
├─ ▾ 📁 references
│ └─ 📋 skill_api_database.json JSON 1L · 22.9 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 extract_functions.py Python 115L · 4.2 KB
│ ├─ 🐍 parse_api_data.py Python 166L · 6.2 KB
│ ├─ 🐍 skill_chatbot.py Python 405L · 16.4 KB
│ └─ 🐍 skill_lint.py Python 332L · 11.6 KB
└─ 📝 SKILL.md Markdown 113L · 3.3 KB

依赖分析 1 项

包名版本来源已知漏洞备注
flask * pip 否 Optional, only needed for --web feature

安全亮点

✓ No shell execution or subprocess usage
✓ No credential harvesting or sensitive data access
✓ No network exfiltration or C2 communication
✓ No code obfuscation or base64-encoded payloads
✓ All functionality matches documentation
✓ Uses standard libraries only (json, re, pathlib, gzip)
✓ Web server feature explicitly documented in SKILL.md
✓ Flask dependency is optional and used for legitimate API querying UI