agent-observatory-sensor.nolimit-observatory.workers.dev

The description instructs the agent to 'Follow start_here.hop first (skill file, 302)' before anything else, and describes chaining into docs, CLI, and 'remote MCP hops.' This is an instruction aimed at the agent's behavior rather than a description of a lookup result, and it directs the agent to fetch and likely execute/parse content from an external, attacker-controllable redirect target ('a public pay-per-call gateway'). This is a classic SSRF/prompt-injection vector: the agent could be led to load remote instructions or a remote MCP endpoint outside the user's awareness, and 'task text discarded' gives false reassurance about data handling while not addressing the redirect-following behavior.

This tool's stated purpose is to locate a 'living people-search index' and hand back API/CLI/remote-MCP hops to it, i.e., it exists to funnel the agent toward a third-party service that aggregates personal information about individuals (a people-search/data-broker product). This is a capability with real potential for harm (doxxing, stalking, unauthorized personal data lookups) that is broader and more sensitive than a simple 'discard the query' utility suggests. The claim that 'query text is discarded' does not mitigate the risk that the tool exists to point the agent at a personal-data harvesting service.