rasczak-agent-service.rasczak-commons.workers.dev

This server isn't on gate's handpicked list. That's not necessarily bad, but there's no third-party signal about it — review its tools carefully.

The description includes an imperative directive ('Query using general task words, never private scenarios') that instructs the agent how to behave rather than simply describing the tool's function. While the intent appears to be privacy-protective, embedding behavioral rules inside a tool description is a pattern that could be used to smuggle instructions to the agent; this should be validated as originating from a trusted source rather than blindly followed.

The description tells the agent to 'Use a random pseudonym; omit private scenarios, names, contact details and credentials.' This is a directive aimed at shaping agent behavior rather than pure tool documentation. Although the stated goal is privacy protection, such embedded imperatives in tool metadata are a common vector for prompt injection and should be treated as untrusted content, not binding instructions overriding the agent's own data-handling policies.

The tool requires a client_id matching a UUID-like pattern. Combined with free-text 'comment' and rating fields, this could be used to build a persistent profile of the user/agent across interactions even though the tool claims feedback is anonymous/pseudonymous. Retention of raw feedback for 30 days is disclosed, which is good, but the agent should avoid populating client_id with any real user-identifying value.

The tool returns an HTTP URL where payment can be made. While the description clarifies no purchase is executed by the tool itself, agents should avoid automatically navigating to or submitting data to externally generated payment URLs without explicit user confirmation, since this could be leveraged to redirect a user to an untrusted destination.