mimikatz_lsadump_dcsync

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral disclosure burden. It does disclose two important traits — that this is an attack and that it requires elevated AD rights. But it omits detectability (DCSync generates notable DC logs such as event 4662), the scale of impact when `all` is used, and what the operation returns, all of which are material for an offensive tool with zero annotation safety signals.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences totaling 14 words: the action is front-loaded and the prerequisite follows immediately. Every word earns its place, with no filler and no restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core action and prerequisites, but with no output schema and no annotations, the agent is left without expected output (dumped hashes), the operational difference between syncing one user versus all users, and risk/detectability warnings. For an offensive credential-replication tool, additional context is needed for correct and safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the schema already documents all four parameters, including the caution flag on `all` and concrete examples for `user`. The description adds no parameter-level detail beyond the schema, which is acceptable but not additive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ('Perform DCSync attack to replicate AD credentials'), clearly identifying both the action and its objective. However, it does not explicitly differentiate this tool from sibling credential-dump tools like mimikatz_lsadump_sam or mimikatz_lsadump_secrets, so the agent must infer the network-replication distinction on its own.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The prerequisite statement ('Requires domain admin or replication rights') provides a concrete condition for when this tool is a viable choice and implies that lower-privileged contexts should use other mimikatz tools. However, it never names alternatives or states when NOT to use DCSync (e.g., when local SAM or memory dumping would suffice), leaving usage guidance implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.