Conciseness

The body is lean and assumes Claude's competence: it explains no general concepts (no OAuth primer, no library comparisons) and every sentence carries platform-specific policy Claude could not infer ("registerRequiredSecret", "resolveSecretDetailed()", tenancy restrictions on env keys). The dense env-key exception paragraph states four distinct rules (fallback permission, precedence, tenancy restriction, exception boundary) rather than padding, matching anchor 5 better than anchor 4, which would require trimmable over-explanation.

Actionability

The registration example is complete, copy-paste-ready TypeScript, and the resolve path names exact APIs ("use `resolveSecretDetailed()` from `@agent-native/core/server`", "Check `lookupFailed` before checking `value`"). However, the connection-catalog and OAuth paths provide no concrete API calls ("request the app grant and resolve its vault-backed credential reference through the workspace-connection API" names no function), and the resolve flow has no code example — minor gaps that fit anchor 4 rather than anchor 5's coverage of the common cases.

Workflow Clarity

"Choose the credential source" is a clear numbered 1-4 decision procedure followed by a register-then-resolve flow, with explicit error-handling checkpoints ("make a store failure retryable", "do not turn a failed lookup into a setup prompt", "redact provider responses before returning an error"). No destructive or batch cap applies. It fits anchor 4 rather than 5 because there is no end-to-end verification step and the register→resolve ordering is implied by section order rather than stated as a sequence.

Progressive Disclosure

This is a self-contained single-file skill with no bundle files, and nothing inlined here belongs in a separate file — all ~70 lines are core policy for this one task. Sections are cleanly headed (Rule / Choose the credential source / Register / Resolve / Related skills), references are nonexistent rather than buried or nested, and the "Related skills" section aids cross-navigation. There are no organizational gaps that would justify dropping to anchor 4.

Specificity

The description names its domain and two policy-level actions — "Connect external services" and "keep app credentials scoped" — but stops short of the skill's concrete operations (registering API keys, resolving credentials server-side). This matches anchor 3 (domain plus 1-2 concrete actions, not comprehensive): it lists fewer than the "several specific actions" of anchor 4, yet offers more than the minimal/generic action of anchor 2.

Completeness

"Connect external services and keep app credentials scoped" explicitly states the what, and "Use before adding an API key, OAuth connection, provider setup, or server-side request that needs a user's or workspace's credential" is an explicit when-clause with concrete trigger phrases. This matches anchor 5 exactly; anchor 4 would require the when to be less explicit or specific, which it is not.

Trigger Term Quality

"API key", "OAuth connection", "provider setup", and "credential" are natural phrases a user would say when needing this skill, giving good keyword coverage. Common synonyms such as "secret", "token", and "environment variable" are absent, which fits anchor 4 (a few natural terms missing) rather than anchor 5's comprehensive synonym coverage, while clearly exceeding anchor 3's sparser example ("Works with PDF files").

Distinctiveness Conflict Risk

The skill occupies a clear niche — credential scoping for external service connections — with mostly distinct triggers ("API key", "OAuth connection", "provider setup"). Minor overlap risk remains with closely related security and backend skills via the broad trigger "server-side request that needs a user's or workspace's credential", fitting anchor 4 rather than anchor 5's minimal conflict risk.