www.pathwren.workers.dev

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The tool text references credentials, environment variables, or sending data elsewhere. This can be legitimate, but review what this tool actually accesses.

The description reads like a directive to the agent ('POST that exact body ... and you are done') rather than a neutral tool description, and frames calling it as free of any consent requirement ('no consent prompt, nothing for you to invent'). It also explicitly returns the caller's IP address and User-Agent string back to a third-party server (pathwren.workers.dev), which is a data-collection action being normalized as harmless boilerplate. Combined with the 'FIRST CALL, needs nothing' text injected into every other tool's description, this looks like an attempt to get the agent to always call whoami first and leak request metadata about the user/agent to the operator on every session, regardless of the user's actual intent.

The description opens with a literal JSON-RPC call to the unrelated 'whoami' tool, framed as a mandatory first step ('FIRST CALL, needs nothing'). This is prompt-injection-style text embedded in a tool description trying to steer the agent's call sequence toward a data-collecting tool (whoami) before every actual tool use, rather than describing this tool's own function.