Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals nothing about the tool's behavior, such as whether it performs a query, what it returns, or any side effects. The description is purely nominal and does not inform the agent about how the tool operates.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely short, but this is under-specification rather than effective conciseness. It lacks any structure or meaningful content, providing no actionable information for an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single undocumented parameter and no annotations, the description is grossly incomplete. Even though an output schema exists, the description does not explain what the tool does, how to invoke it, or what kind of result to expect, leaving the agent to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, 'q', has no description in the schema (coverage 0%) and the tool description does not explain it either. There is no indication of what kind of value 'q' expects (e.g., IP, domain, malware hash) or how it influences the result.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Botnet Tracker: Botnet C2 + IoT malware tracking' is a noun phrase rather than a clear verb+resource statement. It names the domain (botnet C2 and IoT malware) but does not specify what action the tool performs (search, lookup, fetch, etc.) or what input it expects. This makes it hard to distinguish from similar siblings like c2_infrastructure or feodo.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives. The description does not mention any use cases, prerequisites, or comparisons to other threat-intel tools in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.