You used to be able to set yourself up as an HSDir server, and sniff the outgoing hidden service descriptors, but the author has clearly not done this given his level of technical expertise and domain knowledge.