ARIES exposes 24 tools with basic OpenAI-compatible schemas, but quality is inconsistent. All tools have descriptions (positive), but many are terse (10-50 chars), violating the 10-1024 char baseline. Parameter descriptions are sparse or missing entirely. No output schemas documented. No error handling guidance. Tools like 'shell', 'shellBg', 'sandbox', 'kill', 'delete' are high-risk irreversible/destructive operations with no confirmation patterns, dry-run options, or permission gates. Naming is mostly verb-noun (good), but some tools are vague ('done', 'memory'). No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Security concerns: shell/sandbox accept arbitrary code; no input validation visible; no audit trail pattern.

• Add output schemas to all 24 tools. Document return types, field names, and structure. Example: 'read' should return {content: string, lineCount: number, encoding: string}.
• Expand terse descriptions to 50-200 chars. Include WHAT the tool does, WHEN to use it, and any prerequisites. Example: 'delete' → 'Permanently delete a file or directory. Use with caution, this is irreversible. Requires confirmation for safety-critical paths.'
• Add tool annotations: mark read-only tools with readOnlyHint=true (read, ls, search, grep, websearch, web, bg_check, bg_list, memorySearch, desktopScreenshot); mark destructive tools with destructiveHint=true (delete, kill, bg_kill); mark idempotent tools with idempotentHint=true (write, append, edit).
• Implement confirmation patterns for destructive operations (shell, shellBg, sandbox, kill, delete, bg_kill). Add a 'confirm' parameter or require explicit approval before execution. Return actionable error messages: 'Cannot delete without confirmation. Call with confirm=true to proceed.'
• Add input validation and error recovery guidance. For 'shell' and 'sandbox', validate against command injection patterns. Return structured errors: 'Invalid regex in pattern: got "[invalid". Did you mean to escape the bracket?'