Nuclei Scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds several behavioral details beyond the annotations: it requires human approval (AGGRESSIVE), returns inline or as a job_id based on wait_seconds, includes custom rules automatically, and refuses certain tags. These are meaningful disclosures not present in the annotations. It does not detail the potential side effects of active scanning, but the 'AGGRESSIVE' warning and approval requirement cover the main risk. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, with a warning up front, then a brief main statement, followed by a bulleted list of key parameters. It front-loads the critical approval requirement and the core purpose. The parameter list is efficient, though it could be more organized. No wasted words, but it's a bit dense.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 7 parameters, the description covers the essential operational details: approval requirement, inline vs job execution, tag restrictions, and template/workflow semantics. It has an output schema, so return values need not be described. It doesn't explain how 'in-scope' is defined or prerequisites, but those are domain concepts likely covered elsewhere. Overall, it provides enough context for an agent to call it correctly, with minor gaps around severity and concurrency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden for parameter explanation. It explains templates (files/dirs/ids), workflow (file for conditional chaining), tags (comma-separated, with refused ones), and implicitly wait_seconds (via inline vs job behavior). However, it omits severity and concurrency, which are self-explanatory but still undocumented. The description compensates well for the schema gap but not completely.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool scans in-scope targets using Nuclei templates or a workflow. It names the specific engine (Nuclei) and the resource (in-scope targets), which distinguishes it from other scanning tools like nikto_scan or jaeles_scan. The main purpose is unambiguous, though it could be more explicit about what a 'scan' entails (e.g., vulnerability detection).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to choose this over alternative scanning tools. It implies usage for running Nuclei templates, but doesn't mention when to prefer it over jaeles_scan or others. The only conditional guidance is the restriction on dos/fuzz/intrusive tags, which is a prohibition rather than a usage scenario. No when-to-use or when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.