Conciseness

The body is command-first and lean — nearly every section is a short code block with terse, load-bearing comments (e.g. 'mana_loud=0 → Mana selective', 'mana_loud=1 → KARMA universal'), with domain-specific facts (PNL behavior, sequence-number continuity across randomized MACs) that Claude would not reliably know. Not 5 because a few lines re-explain things Claude already knows, such as 'Modern OS (Android 10+, iOS 14+, Windows 10+) use random MACs for probe requests', and the wifiphisher template comments partly duplicate the preceding prose; not 3 because there is no padded filler and the explanations present are niche, not generic.

Actionability

Concrete, mostly copy-paste-ready commands throughout: complete hostapd-mana configs for both open and PSK-clone variants, full dnsmasq config, a parameterized wifiphisher invocation, bettercap one-liners, and a tshark filter. This fits 'Mostly executable guidance; concrete code or commands with minor gaps'. Not 5 because of small fidelity gaps: the bettercap block claims 'Output to /tmp/bettercap_creds.log' without any flag/redirect that would produce it, and the Evidence python blocks use undefined variables (psk, ssid, template_name, bssid) as templates rather than executable code; not 3 because every operational step is a real command with real flags, not pseudocode.

Workflow Clarity

Steps 1-6 form a coherent sequence (harvest → stand up AP → deauth coercion → DHCP/DNS → portal/MITM → MAC-randomization defeat), gated by an explicit RoE hard stop up top, with checkpoints present: 'Cross-reference deauth-pmf skill for PMF detection first', 'check PMF state first' before broadcast deauth, and a ZFP section listing the artifacts that verify each stage succeeded. This matches 'Clear sequence with most checkpoints present; minor validation gaps'. Not 5 because there are no explicit feedback/error-recovery loops (e.g. what to do when no client associates or the portal fails to render); not 3 because per-step preconditions and a closing evidence checklist are actually written.

Progressive Disclosure

No bundle files exist, and the single-file structure is appropriate: clearly headed sections (Prerequisites, Steps 1-6, Evidence, ZFP, OPSEC, References), sibling skills signaled as skill names rather than dead file paths, and external tool references given as URLs. This fits 'Good structure; most content is appropriately placed; references mostly clear; minor organization gaps'. Not 5 because at ~230 lines some self-contained sub-topics (e.g. MAC-randomization defeat or the portal-template catalog) could be split into reference files for a leaner SKILL.md; not 3 because nothing that clearly belongs in a separate file is inlined and navigation via headers is easy.

Specificity

The description lists several concrete, specific actions — 'KARMA/Mana PNL-probe response', 'captive-portal credential capture', and 'post-association MITM for PSK/open networks' — closely matching the anchor 'Lists several specific actions; minor gaps in coverage'. Not 5 because the coverage has minor gaps (no mention of deauth-driven coercion or probe harvesting as capabilities, which are core workflow steps in the body); not 3 because well more than 1-2 actions are named with domain precision.

Completeness

The 'what' is clearly answered (rogue AP, probe response, credential capture, MITM), but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description — the when-guidance lives in metadata.when_to_use, which is a different field. Per the judging guidelines, a missing 'Use when...' clause caps completeness at 3; the clear 'what' keeps it from scoring lower.

Trigger Term Quality

Strong natural keyword coverage — 'evil twin', 'rogue AP', 'KARMA', 'Mana', 'captive portal', 'credential capture', 'MITM', 'PSK/open networks', 'PNL' — all phrases a wireless pentest operator would naturally say, matching 'Good keyword coverage; a few natural terms missing'. Not 5 because common synonyms/tool names users actually say ('wifiphisher', 'hostapd-mana', 'wifi phishing', 'airgeddon') appear only in metadata.when_to_use, not in the description itself; not 3 because synonym coverage here goes well beyond a single generic keyword.

Distinctiveness Conflict Risk

The description carves out a clear niche and explicitly fences off the nearest neighbor: 'Distinct from wpa-enterprise-eap which targets 802.1X', matching 'Clear niche with distinct triggers; minimal conflict risk'. Not 4 because the only plausible overlap (802.1X vs PSK/open networks) is already explicitly disambiguated rather than merely minor.