bb_oob

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only states the tool generates suggestions but does not explain side effects (e.g., making outbound requests), authentication needs, rate limits, or safety profile. The brief description fails to compensate for missing annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is concise and front-loaded with the tool's purpose ('OOB 外带检测辅助'). However, it is too brief to cover necessary details; could be slightly expanded without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (for security testing, has output schema, multiple parameters), the description is incomplete. It does not explain output format, supported modes, or how to interpret the generated payload. An AI agent lacks sufficient information to use the tool effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 2 parameters (mode, callback_url) with 0% description coverage. The description does not explain parameter roles, valid values for 'mode', or how to use 'callback_url'. Without schema descriptions, the tool description should provide this context but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states tool assists OOB detection for Blind SSRF/XXE/RCE by generating callback identifiers/payload suggestions. The verb '生成' (generate) and resource '回调标识/Payload 建议' are specific. However, it does not explicitly differentiate from sibling tools like bb_ssrf or bb_xxe, which might have overlapping purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description implies usage context ('用于 Blind SSRF/XXE/RCE 验证') but lacks explicit guidance on when to use this tool vs alternatives like bb_ssrf or bb_xxe. No when-not-to-use or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.