Conciseness

Lean, well-organized playbook that assumes Claude's competence; only a brief opening framing paragraph ('A permissive ACAO becomes critical...') could be trimmed, otherwise every token earns its place.

Actionability

Provides copy-paste-ready curl probing commands, an executable credentialed-fetch PoC, a sandboxed-iframe null-origin variant, and concrete tool invocations covering the common exploitation cases.

Workflow Clarity

Clear numbered sequence (detect → matrix → exploit → chains → tools → OPSEC) culminating in an explicit decision-gate checklist with an escalation/downgrade feedback loop that validates before exploitation.

Progressive Disclosure

Well-organized single-file structure with clear section headers and no nested references; slightly above the simple-skill threshold in length, with minor opportunity to split the PoC/matrix into separate reference files.

Specificity

Lists multiple concrete exploitation techniques — 'reflected origin, null origin, trusted-subdomain abuse, regex-validation bypass, and credentialed cross-origin data theft' — giving comprehensive coverage of the CORS attack surface.

Completeness

The 'what' is clear and detailed, but there is no explicit 'Use when...' trigger clause; per the rubric, a missing explicit trigger guidance caps completeness at 3.

Trigger Term Quality

Includes natural terms users say ('CORS', 'cross-origin', 'origin', 'credentials') but omits common variations like 'Access-Control-Allow-Origin'/'ACAO' from the description itself; good but not comprehensive.

Distinctiveness Conflict Risk

Carves a clear CORS-exploitation niche with distinct triggers and minimal overlap risk with other web-testing skills.