Conciseness

The ~93-line body packs threat-profile seed, an 11-phase kill-chain routing table, CONOPS, OPSEC, RoE gates, deconfliction, and fidelity notes with zero filler — it never explains concepts Claude already knows (what a DLL side-load or a DeFi bridge is) and assumes competence throughout. Every section maps to a concrete planning artifact, matching the level-5 anchor ('lean and efficient; every token earns its place'); level 4 would require trimmable over-explanation, and none is evident.

Actionability

Guidance is copy-paste ready: the complete `plan/threat-profile.json` seed JSON, exact routing paths per phase (e.g. `/skills/standard/contracts/bridge-exploit/SKILL.md`), a numbered CONOPS to copy into `conops.json`, and verbatim EMERGENCY-abort language. Per the rubric's instruction-only-skill note, absence of code is not penalized when guidance is actionable — and this is fully actionable with specific named artifacts (`deconfliction.json`, `cleanup.json`). It exceeds level 4 ('minor gaps'): execution detail is deliberately and correctly delegated to the routed sub-skills.

Workflow Clarity

The 11-phase sequence is clearly numbered, mapped to MITRE techniques and CONOPS stages, and includes explicit safety checkpoints (MUST-run-on-fork rule, verbatim `EMERGENCY` abort criterion, lure deconfliction requirement). However, for inherently destructive on-chain operations (phases 7–11) there is no explicit pre-flight validation step in the sequence itself — e.g. 'verify the RPC endpoint is an Anvil fork/testnet before executing phases 7–9' — so the level-5 anchor's 'explicit validation steps' is not fully met; this fits level 4 ('clear sequence with most checkpoints present; minor validation gaps') better than level 5.

Progressive Disclosure

The SKILL.md is itself an overview that routes all execution detail to one-level-deep, clearly signaled sub-skill paths (dedicated routing column in the kill-chain table, plus inline links like `(see ../../references/apt-groups.md)` and the lure-deconfliction path in RoE). No content that belongs in a separate file is inlined; the structure matches the level-5 anchor (clear overview with well-signaled one-level-deep references, easy navigation), which is why it sits above level 4 rather than merely at it.

Specificity

The description names the domain ("adversary-emulation playbook") and lists multiple concrete action classes — "fake-job social engineering, trojanized apps, wallet/key theft, and on-chain DeFi/bridge exploitation" plus "supply-chain intrusion" — comprehensively covering the actor's TTP surface. It clearly matches the level-5 anchor (multiple specific concrete actions, comprehensive coverage) and exceeds level 4, which anticipates gaps in coverage; none are apparent.

Completeness

Both questions are explicitly answered: what ("Lazarus Group ... adversary-emulation playbook — financially-motivated crypto/DeFi theft and supply-chain intrusion: ...") and when ("Use when emulating DPRK financial actors against a crypto/exchange/DeFi target. Triggers on: ..."). This matches the level-5 anchor — clear 'what' and 'when' with concrete trigger phrases — and is well above level 4's 'when could be more explicit'.

Trigger Term Quality

Explicit trigger phrases cover the natural vocabulary of this niche with synonyms: "'emulate Lazarus', 'Hidden Cobra', 'DPRK crypto', 'AppleJeus', '3CX supply chain', 'DeFi bridge attack', 'crypto theft'", reinforced by in-body phrases like "fake-job social engineering" and "wallet/key theft". Coverage is comprehensive for the domain (a user emulating this actor would naturally say these terms), fitting the level-5 anchor; level 4 ('a few natural terms missing') would understate it — even variations like ZINC/Diamond Sleet appear in the frontmatter's when_to_use metadata.

Distinctiveness Conflict Risk

A named-threat-actor (Lazarus/Hidden Cobra, G0032) emulation niche with operation-specific triggers ('AppleJeus', '3CX supply chain') is unambiguous and would not fire for unrelated skills; the only conceivable overlap is with sibling DPRK actor-emulation skills, which the actor-specific triggers disambiguate. Fits the level-5 anchor (clear niche, distinct triggers, minimal conflict risk).