Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden, but the description only states the cryptographic security property. It doesn't disclose the output format, the relationship between length and encoding, whether the output is returned as a string, or any binary-decoding behavior. The term 'cryptographically secure' is a useful security property, but the overall behavioral disclosure is minimal for a tool that has multiple behavioral dimensions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.