Conciseness

The body is dense and command-first with every section earning its place, but the tool-reputation bullets (VirusTotal/Shodan/Censys roles) and the illustrative org-chart tree are minor over-explanation of things Claude already knows. Fits 'efficient; minor instances of over-explanation that could be trimmed' — below 5 (some trimming possible) but well above 3 (no padded sections).

Actionability

Mostly copy-paste-ready commands with sensible <target> placeholders (theHarvester invocations, curl API calls, dig, grep patterns, Google dorks), but sections like 'Domain Reputation' and 'Credential Intelligence (What to Document)' are descriptive checklists rather than executable guidance. Fits 'mostly executable guidance; concrete code or commands with minor gaps' — below 5 (some sections are not executable), above 3 (the bulk is concrete and complete, not pseudocode).

Workflow Clarity

Section 8 gives a clear, ordered 9-step OSINT sequence with each step mapped to a concrete technique. Validation checkpoints are absent (no 'verify API key' or 'handle empty results' steps), but the workflow is passive/read-only so the destructive/batch cap at 3 does not apply. Fits 'clear sequence with most checkpoints present; minor validation gaps' — above 3 (sequence is explicit and coherent, not merely listed), below 5 (no explicit validation or feedback loops).

Progressive Disclosure

Single 235-line file with well-organized, clearly headed sections covering distinct OSINT phases; no bundle files exist so there are no buried or nested references. It exceeds the 50-line simple-skill threshold, and deep detail (dork lists, per-tool API usage) could arguably be externalized into reference files. Fits 'good structure; most content is appropriately placed; minor organization gaps' — below 5 (no references to signal, above the simple-skill exception) and above 3 (nothing is misplaced or poorly navigable).

Specificity

The description lists six concrete actions ('email harvesting, social media profiling, breach data checking, employee enumeration, GitHub secret scanning, organizational mapping'). Fits 'lists several specific actions; minor gaps in coverage' — below 5 because the body also covers domain/IP intelligence and Google dorking, which the description omits, and above 3 because it names far more than 1-2 actions.

Completeness

The 'what' is clear (open-source intelligence gathering plus a list of concrete actions), but there is no 'Use when...' clause or equivalent explicit trigger guidance in the description, so the rubric's cap applies. Matches anchor 3 ('has a clear what but when is missing or only weakly implied') exactly — not 4, which requires an explicit 'when'.

Trigger Term Quality

Terms like 'OSINT', 'email harvesting', and 'breach data checking' are natural phrases a user needing this skill would say, plus tool-adjacent phrasing like 'GitHub secret scanning'. Fits 'good keyword coverage; a few natural terms missing' — below 5 because common variations like 'recon', 'dorking', or 'footprinting' are absent, and above 3 because coverage goes beyond a couple of generic keywords.

Distinctiveness Conflict Risk

'Open-source intelligence gathering' carves out a clear niche distinct from technical-recon skills, and the named actions are specific triggers. Fits 'mostly distinct; minor overlap risk with closely related skills' — below 5 because the umbrella over sub-techniques like email harvesting and secret scanning could overlap with single-technique recon skills in a larger library, and above 3 because it is far from generic.