Tool Metadata Is Data

A tool's name and description arrive with the same authority as the system prompt, which is the problem. The description is written by whoever published the tool, and an agent reads it as guidance before it decides anything.

A clean contract says what goes in, what comes out, and what side effects to expect. When the text starts telling the agent what to do instead, it has crossed from contract into instruction and belongs in the untrusted pile.

def instruction_like(desc):
    marks = ['ignore', 'instead', 'secret', 'credential']
    return [m for m in marks if m in (desc or '').lower()]

The check is crude on purpose. A crude check that runs on every tool beats a clever one that runs sometimes.