Is compass@1.1.11 safe to install?

compass@1.1.11

VERIFIED

Publisher claims: "Look up real-estate listings, property details, photos, price history, and resolve addresses on Compass via MCP. Triggers on phrases like "find homes on compass in", "compass property details for", "compass photos for", "compass price history for", "resolve this address on compass", "compare these compass listings", "what does compass say about", or any request involving Compass properties, prices, or comparisons. Requires compass-mcp installed and the ContextMint Bridge extension active (see Setup below)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher chrischall · joined 8 days agoInstalls 750Last detonated 1 h ago

$clawhub install compass

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Prompt injectionSKILL.md:36 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST01

HIGH

Authorization escalation languageSKILL.md:36 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01