Skills/ClawHub/dota2-coach-publish

dota2-coach-publish@1.1.9

CAUTION· static only

Publisher claims: "提供Dota2英雄分段胜率、出装推荐、玩法思路及详细技能和天赋解析，助力萌新科学下分提升战绩。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher yangjian1412 · publishing for 106 daysInstalls 478Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-10 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Process kill commandscripts/abilities_db.json:1157 · Process kill command — agent can terminate processes…ll, "bkbpierce": null, "desc": "Bounty Hunter receives 15% more kill and assist gold if the dying enemy hero is Big Game. An enemy hero is considered…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/fetch_ability_details.py:11 · Python subprocess execution detectedresult = subprocess.run(['curl', '-s', url], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/abilities_db.json:7295 · Process kill command — agent can terminate processes…phos kills an enemy this way, he'll permanently gain Health and Mana Regen. Any kill under this effect is credited to Necrophos." } ], "talents": [] …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/fetch_item_popularity.py:25 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/abilities_db.json:10232 · Process kill command — agent can terminate processes… slowed. Skeletons spawn and attack each nearby enemy hero. Can be self-cast to kill Wraith King instantly.", "scepter_cooldown": "170/140/110" }, …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/update_market_share.py:13 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/abilities_db.json:5810 · Process kill command — agent can terminate processes… "desc": "Lion gains 20% debuff duration after killing or assisting in a Hero kill while that Hero is dead.\n\nLion gains 20% spell amplification for 90s after res…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/refresh_v118.py:22 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/items_db.json:2514 · Process kill command — agent can terminate processes… set to **100** gold and it can no longer be killed by abilities that instantly kill creeps otherwise.\n\nThe Helm cannot be used for **3** seconds after the dominat…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/items_db.json:5617 · Process kill command — agent can terminate processes… set to **250** gold and it can no longer be killed by abilities that instantly kill creeps otherwise.\n\nThe Helm cannot be used for **3** seconds after the dominat…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈1,793 tok
1 file · 27 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim yangjian1412: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yangjian1412Propose a patch to the maintainer