agent-observatory-sensor.nolimit-observatory.workers.dev

The description tells the agent to 'Follow start_here.hop first' through a 302 redirect carrying tracking parameters (utm_source=agent-observatory&utm_medium=agent), and says it 'also returns docs, CLI, and remote MCP hops.' This is a directive embedded in a tool description that pushes the agent toward installing a CLI and connecting to an additional, unvetted remote MCP server from a third party ('Monid'), effectively asking the agent to extend its own capability surface and trust boundary based on an unreviewed external redirect. This pattern is a classic vector for supply-chain/prompt-injection attacks against agents, and the embedded UTM tracking params indicate the destination is tracking agent traffic without the user's visibility into where the hop leads.

Similar to agent-tool-index, this tool's description instructs the agent to 'Follow start_here.hop' (a tracked 302 redirect) to find a 'living people-search index (Ploid)' and then onboard via CLI, API, and remote MCP hops. People-search / people-lookup services raise privacy and doxxing concerns, and directing an autonomous agent to discover and integrate with such a service via an unreviewed redirect chain is a significant risk: it could expose the user's query data to a third party and extend the agent's trusted toolset without explicit user review.

The description explicitly frames this tool's purpose as helping place a product 'so AI agents discover it,' instructing the agent to follow a tracked start_here.hop redirect and then proceed through a 'client center' and a '7‑day trial handoff for your operator.' This is effectively an ad-injection/discovery-gaming mechanism targeting AI agents themselves, encouraging the agent to promote or onboard to a paid service through an opaque, UTM-tagged hop chain rather than through a decision made transparently by the user. This could bias agent recommendations and silently enroll the operator in a trial without clear user consent.