Conciseness

The body is lean and operational: every section is a runnable command, a classification table, a PoC, or severity-triage rules ("ACAO alone (no credentials) is usually Low unless..."). There is no "what is CORS" tutorial padding or library-comparison fluff, so every token earns its place. The two-sentence intro is skill-specific triage guidance, not generic concept explanation, so it does not pull the score to 4.

Actionability

Guidance is fully executable: copy-paste curl probe loops (with only the standard <TARGET> placeholder), an OPTIONS preflight probe, complete fetch-based exfiltration PoCs including the sandboxed-iframe variant for null-origin servers, exact exploit-origin strings per misconfig class (e.g. "https://appxtarget.com" for the unescaped-dot flaw), and concrete tool invocations. Not below 5 because the common cases (reflection, null, prefix/suffix/regex flaws) are each covered with a specific exploit origin.

Workflow Clarity

A clear numbered sequence runs detection → classification → PoC → chains → OPSEC, with an explicit confirmation checkpoint in section 1 ("A response echoing ACAO: https://evil.com and ACAC: true confirms exploitable reflection") and a closing Decision Gate checklist with conditional routing (all checked → escalate; otherwise → downgrade to informational). This matches the top anchor's "explicit validation steps" and "checklists for complex processes"; it is not 4 because no validation checkpoint is missing.

Progressive Disclosure

The single file is well-sectioned and appropriately sized (~90 lines) with no bundle files to reference, and no content is inlined that clearly belongs in a separate file. It falls short of 5 because "escalate per `finding-protocol`" is a dangling reference — no path, link, or definition is given within the skill, so navigation to that dependency is unclear.

Specificity

The description names the domain ("CORS misconfiguration exploitation") and enumerates five concrete attack classes — "reflected origin, null origin, trusted-subdomain abuse, regex-validation bypass, and credentialed cross-origin data theft" — which comprehensively covers the CORS misconfig space. It is not below 5 because no meaningful capability class is omitted, and not below 4 because the items are specific techniques, not generic categories.

Completeness

The "what" is clear and specific (exploit these five classes of CORS misconfiguration), but there is no "Use when..." clause or equivalent explicit trigger guidance in the description — the when is only weakly implied by the topic itself. Per the judging guideline, a missing 'Use when...' clause caps completeness at 3; it is not 2 because the "what" half is fully present.

Trigger Term Quality

Good natural-keyword coverage: "CORS", "misconfiguration", "origin", "cross-origin", "data theft" are terms a user testing a web target would actually say. It falls short of 5 because common synonyms like the full header name "Access-Control-Allow-Origin" (only present in metadata.when_to_use, not the description) and variations like "CORS policy" or "preflight" are absent from the description itself.

Distinctiveness Conflict Risk

"CORS misconfiguration exploitation" is a clear niche with distinct triggers; no other common skill type (generic web scanning, XSS, SSRF) would plausibly claim these exact triggers, so conflict risk is minimal. Nothing vague remains that would overlap with sibling skills.