android_secrets_scanner

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it partially does so by disclosing the concrete mechanics (strings on classes*.dex and resources.arsc, text asset scanning) and how behavior changes with smali_folder. It says nothing about return format, whether findings are deduplicated/rated, expected runtime on large APKs, or whether the APK is modified — all relevant for a scanner with no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, purpose front-loaded, then the mode-conditional behavior in a single parallel construction. No filler and nothing repeated from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no annotations and no output schema, the description should say something about what findings look like (fields, confidence, format). It covers method and scope well but leaves the entire result contract unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so apk_path and min_length are already documented by the schema; the description adds real semantic value only for smali_folder by explaining it must be apktool output and how presence changes the scan strategy. min_length is never referenced in the description, so it adds no coverage beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Scans an APK for hardcoded secrets and API keys') and implicitly separates itself from the iOS sibling by naming APK as the target. An agent can tell immediately this is the Android secret-scanning tool, not the API extractor or manifest analyzer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The with/without smali_folder split gives explicit conditional guidance on which mode applies depending on whether apktool output exists, and it explains what each mode scans. It does not say when to prefer this over android_api_extractor or what happens if both a secrets scan and an API extraction are needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.