Tool Description Security Guide

Description

Tool descriptions are the new primary attack vector. This guide shows how to write tool descriptions that don’t leak, don’t chain, and don’t lie.

Why Tool Descriptions Are Attack Surface

The LLM decides which tools to call from their names and descriptions. That makes descriptions:

1. **A prompt injection channel** – a description that says “use this tool for anything” invites abuse

2. **A chaining enabler** – “Agent tools look safe alone; their chains decide the breach.” Two harmless-looking tools chained become a dangerous capability

3. **A leak vector** – descriptions that reveal internal paths, keys, or capabilities give an attacker a map

Rules for Safe Descriptions

1. **Least-privilege descriptions** – describe exactly one capability. “Get order status by ID” not “Access order system”

2. **No secrets in descriptions** – no URLs with tokens, no internal hostnames, no credential hints. The description is visible to the model and to anyone who can prompt the model

3. **No chaining language** – avoid “and then”, “also”, “or use this to” – each tool does one thing

4. **Documentation discipline** – “your tool descriptions are lying by omission” when you only test happy paths. Document failure modes: what the tool returns on error, what it refuses to do

5. **Treat descriptions as code** – review them like code, version them like code, audit them like code

The Chain Attack

A tool that reads files + a tool that sends HTTP = exfiltration, even though neither tool alone is dangerous. Mitigations:

– Separate trust domains for read tools and send tools

– Require explicit approval for cross-domain chains

– Log tool chains, not just individual calls

Checklist

– [ ] Each description covers exactly one capability

– [ ] No secrets, paths, or internal names in descriptions

– [ ] No chaining language (“and then”, “also”)

– [ ] Failure modes documented (what happens on error)

– [ ] Read tools and send tools in separate trust domains

– [ ] Tool chains logged and reviewed