websex_metasploit

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose useful execution semantics: argv tokens are passed directly to msfconsole with no shell parsing, and execution is namespaced to the selected engagement. It says nothing about destructive potential, authorization/scope requirements, runtime duration, or interaction patterns for an exploitation tool, which is a notable gap given zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with purpose front-loaded, then invocation mechanics, then path convention. No filler; each sentence contributes. Not quite a 5 only because the invocation details could be grouped more crisply.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation. For a 4-parameter, un-annotated exploitation tool, however, the definition leaves `stdin` undocumented and omits any statement of scope, blocking behavior, or safety expectations — an agent could call it correctly at the mechanical level but not with full awareness of consequences.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% for 4 parameters, so the description must compensate. It clarifies the semantics of `arguments` (raw argv tokens, no shell parsing), implicitly the engagement namespace for `engagement_id`, and gives guidance for `working_directory` (relative paths for engagement artifacts). The `stdin` parameter is never addressed, and no formats or constraints are given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: running Metasploit's `msfconsole` via the WebSex toolkit, with the argv-token invocation model named explicitly. It is distinguishable from `websex_msfvenom` and `websex_exploit_search`, though it doesn't say how it differs from generic executors like `websex_execute` or `websex_bash`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No indication of when to use this over `websex_exploit_search`, `websex_msfvenom`, or the generic `websex_execute`. The only guidance is mechanical ('use relative paths'), not selection-oriented, so an agent gets no help choosing between the many execution/exploitation siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.