Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavioral effects. It fails to mention that this is a mutating action with security implications, whether the new password is returned (since no password parameter exists in the schema), what happens to the old password, or any permission requirements. The bare 'reset' provides no insight into consequences or response behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.