Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond readOnlyHint and openWorldHint, the description discloses what is actually inside the payload (both llms.txt and llms-full.txt bodies) and adds a security-critical instruction that the bodies are third-party text to be treated as quoted data, not instructions. That prompt-injection warning is behaviorally important and appears nowhere in the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.