Dota2 Coach
AdvisoryAudited by Static analysis on May 7, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If you request a data update, the agent may contact public Dota/OpenDota endpoints and change the skill's local data files.
This optional updater fetches public item statistics and overwrites the local item_popularity.json database. It matches the disclosed data-refresh purpose but gives the agent network and file-mutation capability if the user asks it to update data.
url = f'https://api.opendota.com/api/heroes/{hero_id}/itemPopularity' ... subprocess.run(['curl', '-sL', url, ...]) ... json.dump(existing, f, ensure_ascii=False, indent=2)Use normal advice queries for offline/local behavior, and only approve update-script runs when you intentionally want refreshed public Dota data.
A manual refresh may fail or behave differently if curl is unavailable, despite the metadata saying no binaries are required.
A maintenance script depends on the external curl binary, while the registry requirements declare no required binaries. Because this is optional and purpose-aligned, it is a metadata/dependency note rather than a security concern.
result = subprocess.run(['curl', '-s', url], capture_output=True, text=True)
Treat the refresh scripts as optional maintenance tools; review them and ensure expected tools are present before running them.