hijack_dangling_cname

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral disclosure burden. It describes the detection process (DNS resolution, NXDOMAIN/SERVFAIL check, HTTP confirmation) but omits potential side effects like network requests to third-party targets, rate limits, or safety implications. This is moderate transparency for a scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, with the first sentence stating the primary purpose and the second detailing the method. No redundant information, front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema is present, and the description does not explain return format, result structure, or potential pitfalls. For a security scanning tool, this is a notable gap. However, the description provides a clear process overview, making it minimally adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both parameters (domain and subdomains) having clear descriptions. The tool description adds no new meaning beyond restating that it scans subdomains. Baseline 3 is appropriate since the schema already handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it detects dangling CNAME records for subdomain takeover, using a specific verb ('Detect') and resource. This distinguishes it from siblings like hijack_dangling_ns and hijack_dangling_mx, which target other record types.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for CNAME-specific takeover checks by mentioning 'Resolves CNAME for each subdomain.' While it doesn't explicitly mention alternatives, the context is clear and excludes other record types. No exclusions are stated, so it fits 'clear context, no exclusions.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.