ad_bloodyad

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only says 'AD privilege escalation via bloodyAD' without explaining what actions it performs, whether it modifies AD objects, what credentials are needed, what the tool outputs, or any side effects. This is a significant transparency gap for a security tool that likely makes changes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short sentence, so it is technically concise, but it is under-specified. It fails to deliver any useful detail beyond a general statement. The brevity is not 'appropriate' because it omits essential information that should be present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 6 parameters, no schema descriptions, no annotations, and no output schema, the one-line description is completely inadequate. It does not explain what bloodyAD subcommands are possible, how arguments map to operations, or what the tool returns. The agent has almost no basis for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no parameter information. The parameters domain, username, password, host, subcommand, and additional_args are entirely unexplained. Critically, subcommand is likely the core parameter for choosing the bloodyAD action, but no context is provided for how it should be used.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'AD privilege escalation via bloodyAD.' It identifies a specific tool (bloodyAD) and a clear action (privilege escalation) on a resource (Active Directory). This distinguishes it from sibling tools like ad_secretsdump or ad_kerberoast, though it remains general about which exact operations are supported.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives. There is no mention of scenarios, prerequisites, or comparisons to sibling tools such as ad_ldap_enum or ad_certipy. The only implied usage is 'when you need AD privilege escalation,' but this is too broad and not explicit enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.