Dota2 Coach
PassAudited by ClawScan on May 7, 2026.
Overview
This appears to be a Dota 2 advice skill that mostly reads bundled game data, with optional user-directed scripts to refresh public statistics.
This skill looks safe to use for Dota 2 coaching. Be aware that if you ask it to update its data, it may run local Python/curl helpers that fetch public game statistics and modify bundled JSON files. Do not provide credentials or enable scheduled/background updates unless you intentionally choose to maintain the data yourself.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you request a data update, the agent may contact public Dota/OpenDota endpoints and change the skill's local data files.
This optional updater fetches public item statistics and overwrites the local item_popularity.json database. It matches the disclosed data-refresh purpose but gives the agent network and file-mutation capability if the user asks it to update data.
url = f'https://api.opendota.com/api/heroes/{hero_id}/itemPopularity' ... subprocess.run(['curl', '-sL', url, ...]) ... json.dump(existing, f, ensure_ascii=False, indent=2)Use normal advice queries for offline/local behavior, and only approve update-script runs when you intentionally want refreshed public Dota data.
A manual refresh may fail or behave differently if curl is unavailable, despite the metadata saying no binaries are required.
A maintenance script depends on the external curl binary, while the registry requirements declare no required binaries. Because this is optional and purpose-aligned, it is a metadata/dependency note rather than a security concern.
result = subprocess.run(['curl', '-s', url], capture_output=True, text=True)
Treat the refresh scripts as optional maintenance tools; review them and ensure expected tools are present before running them.