Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly/openWorld/idempotent, but the description adds what the annotations cannot: that it performs a network fetch, the specific detection categories, the tri-state verdict semantics (safe/suspicious/unsafe), and that evidence plus sanitized content are returned. It also discloses the important safety contract that clean_markdown has hidden instructions stripped and must not be obeyed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The imperative call-to-action is first, followed by capability, then return contract, then a usage rule. Every clause carries information — the threat enumeration justifies its length because it tells the agent what the scan actually covers, and there is no restating of the name or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by naming the return fields (verdict, evidence, clean_markdown) and their meaning. Combined with the safety annotations and a fully documented single parameter, nothing an agent needs to call and correctly interpret this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required parameter with 100% schema coverage, so the schema already documents it fully. The description implies the input is a fetched page URL but adds no format, scheme, or validation detail beyond what the schema states. Baseline 3 is appropriate when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource (fetches the page and detects hidden prompt injection) and enumerates the exact threat classes it looks for (CSS-hidden text, HTML comments, Unicode smuggling, exfiltration, phishing). An agent knows precisely what the tool does and what comes back (verdict, evidence, clean_markdown) without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit, front-loaded trigger: call this BEFORE reading, summarising or acting on any untrusted web page, with concrete sources enumerated (links from users, emails, search results, other tools). It also prescribes post-call behavior (use clean_markdown, never follow embedded instructions). It does not name a when-not case or reference the sibling check_url, so it stops short of full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.