Conciseness

The body is lean and operational: no explanation of what DNS, SPF, or Punycode are; the two-sentence intro states only operational stakes ('modern inboxes drop the mail and browsers flag the page'), and every section delivers instructions or a concrete record/command block. Matches anchor 5 — it assumes Claude's competence and every token earns its place; it is above anchor 4 because there is nothing to trim.

Actionability

Mostly executable guidance: the idna Punycode snippet, the acme.sh issue command, and the dig/swaks verification commands are copy-paste ready, and the DNS block gives exact record shapes. It falls short of anchor 5 because key details are placeholders with no generation steps — the DKIM record shows 'p=<pubkey>' without how to generate the key pair, and '<sandbox-ip>' / NS delegation are named but not commanded.

Workflow Clarity

There is a clear sequence (choose name -> DNS -> TLS -> 'Verify before sending' -> Evidence -> Failsafe) with an explicit verification checkpoint using concrete commands. It is not anchor 5 because there is no error-recovery loop — the verify section never says what to do when SPF/DKIM/DMARC alignment fails — and not anchor 3 because the validation step is explicit, current, and placed correctly before sending.

Progressive Disclosure

The body is well-organized into seven focused sections with no bundle files and no nested references, and external paths it does cite (plan/roe.json, plan/phisher/infrastructure.md) are one level and clearly signaled. It misses anchor 5 because at ~69 lines it exceeds the under-50-line simple-skill threshold and some detail (DKIM key generation, the lure-deconfliction handshake, the failsafe repoint procedure) naturally belongs in reference files.

Specificity

The description lists several concrete actions — 'Register and provision a lookalike / Punycode phishing domain with DNS and TLS' — and names specific integration targets ('GoPhish and evilginx2 lures'). It stops short of anchor 5 because the mail/browser checks are named generically ('pass modern mail + browser checks') rather than concretely as SPF/DKIM/DMARC/ACME, which do appear only in metadata.when_to_use, leaving minor coverage gaps.

Completeness

The 'what' is explicit and clear: 'Register and provision a lookalike / Punycode phishing domain with DNS and TLS'. There is no 'Use when...' clause or equivalent explicit trigger guidance in the description — the when is only weakly implied via 'so GoPhish and evilginx2 lures resolve' — so per the judging guidelines completeness is capped at 3. It is above anchor 2 because the 'what' is fully concrete, not vague.

Trigger Term Quality

The description contains natural terms users would say: 'lookalike', 'Punycode', 'phishing domain', 'DNS', 'TLS', 'GoPhish', 'evilginx2'. It is not anchor 5 because common variations users might say — 'typosquat', 'IDN homograph', 'homograph attack' — are absent from the description itself (they exist only in the metadata when_to_use field, which is not the evaluation target).

Distinctiveness Conflict Risk

The description carves out a clear niche — lookalike/Punycode phishing domain provisioning for GoPhish and evilginx2 — with trigger terms ('lookalike', 'Punycode', 'phishing domain') that no other plausible skill would claim. Minimal conflict risk; matches anchor 5.