Audit script execution footprint and local detection exposure

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/idempotent/non-destructive/non-openWorld, yet the description adds substantial non-structured behavior: what it will never do (never sends input, never invokes the closure, never walks getgc/descendants, never installs hooks, never writes), plus the critical caveat that a clean result does not prove no server-side/external detection and that cloneref/clone matches are provenance only, not undetectability guarantees.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The key identity ('READ-ONLY... auditor') is correctly front-loaded, but the core is one very long run-on sentence enumerating many operations, followed by caveats and metadata. It is information-dense rather than padded, yet it is hard to scan and could be split into a purpose line, a returns line, and a caveats line.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully enumerates the return payload (findings, unknown checks, confidence, risk score, privacy-safe evidence, truncation telemetry) and covers prerequisites, safety boundary, and failure handling. What remains thin is the distinction between the many limits and how to choose values, but overall it is complete enough for an agent to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each of the 11 parameters is already documented in the schema; baseline is 3. The description restates the signature and mentions bounding generally ('bounded getsenv/getfenv key-name leaks') but adds no semantics beyond what the schema descriptions already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence names a specific verb+resource ('READ-ONLY, one-shot Luau auditor for local execution exposure') and then enumerates exactly what it does: resolves script/closure, inventories virtual-input globals, compares signatures, audits getsenv leaks, classifies closure origin, scans source. It also distinguishes itself from neighbors by ruling out hook installation and getgc/descendant walking, so an agent can separate it from scan-hook-surfaces or list-gc-functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear invocation context ('Phase: verify; cost=medium; idempotency=read-only', 'Requires: active-client, resolved-target') and a failure path ('inspect tool-schema for exact fields'). It does not name an alternative sibling or state when-not to use it, so it stops short of explicit routing but the context is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.