Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and openWorld hints, but the description adds crucial behavioral context: it costs $5 per call, returns a PROCEED/CAUTION/BLOCK verdict, and performs 'hard block' on certain conditions. These details go well beyond the annotations and directly inform the agent's decision-making.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence that front-loads the core action and then enumerates risk categories and the verdict. The dash-list format is efficient, though it borders on a run-on. Every clause adds value, and the cost is stated at the end as an important caveat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a medium-complexity tool with a nested source object and no output schema. The description covers the main input types (git repo, SKILL.md), the analysis dimensions, and the output verdict. It lacks a brief example of source construction, but given the schema's enum and the tool's focused purpose, the description is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers previous_scan_id with a full description, but source is undocumented. The description partially compensates by mentioning 'git repo or SKILL.md', which aligns with the source.type enum, but it does not explain how to structure the source object (url vs skill_md). With 50% schema coverage, the description adds some meaning but not enough to fully bridge the gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Scan' and the resource 'an agent SKILL', with specific scope (git repo or SKILL.md) and a concrete purpose (supply-chain risk). It distinguishes from sibling tools like scan_mcp_plugin by targeting SKILLs specifically.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'BEFORE trusting it' provides explicit timing for use, and the listed checks (prompt-injection, over-broad grants, exfiltration) imply a pre-adoption security review context. It doesn't explicitly name alternatives or exclusions, but the SKILL-specific focus makes the use case clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.