Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds two things annotations cannot: the required `inbox:read` scope and a warning that user-authored text appears in untrusted_fields and must not be treated as instructions. That prompt-injection caveat is meaningful behavioral context, though it does not describe error behavior for a missing or unauthorized conversation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.