Conciseness

The body is dense practitioner reference material: a sink/safe-API table by language, terse audit commands ("semgrep --config p/sql-injection …", "grep -rE 'ORDER BY.*\$|LIMIT.*\$|GROUP BY.*\$' …"), and a compact CVSS table. It never explains what SQL injection is or how ORMs work — it assumes Claude's competence and every section earns its place, matching anchor 5 ("Lean and efficient; every token earns its place"). The one flourish ("Classic, still the king.") is a single clause flagging relevance, not padding. Not 4 because there is no over-explanation to trim.

Actionability

Fully executable, copy-paste-ready guidance throughout: a concrete semgrep command with SARIF output paths, targeted grep regexes for scanner blind spots ("\.raw\(|\.extra\(", dynamic ORDER BY/LIMIT/GROUP BY), ready curl PoC payloads with expected success signals ("response time > 5s", "mysql error with version string reflected"), and a validate_finding contract with concrete success/negative patterns — matching anchor 5 ("Fully executable; copy-paste ready code or commands; specific examples cover the common cases"). Not 4 because there are no missing key details for the common cases.

Workflow Clarity

Numbered sections form a coherent sequence: sources (§1) → sinks (§2) → audit steps (§3) → special subclasses (§4–6) → PoC validation (§7) → scoring (§8) → chaining (§9). Validation is explicit with a feedback rule: "negative_command: same URL with q=1 (no payload)" plus "if present without payload, it's unrelated noise — demote" — a negative-control checkpoint with a demote action, matching anchor 5 ("Clear sequence with explicit validation steps; feedback loops for error recovery"). Not 4 because the checkpoints are explicit rather than only "most" present.

Progressive Disclosure

No bundle files exist (references/, scripts/, assets/ are all absent) and none are needed: the ~110-line body is core playbook content (sink tables, audit commands, validation contract, CVSS defaults) appropriately kept inline at this size, organized into nine clearly headed, navigable sections — matching the well-organized self-contained top anchor. Not 4 because there are no organization gaps: sections are cleanly separated, clearly titled, and nothing that belongs in a separate file is inlined.

Specificity

Quotes: "Hunt SQL injection (CWE-89) via source-level taint tracking. Covers string concat, format-string, ORM raw queries, second-order injection, and NoSQL injection in MongoDB/DynamoDB." The description names the domain, a concrete methodology, and enumerates several specific vulnerability classes it covers — matching anchor 4 ("Lists several specific actions; minor gaps in coverage"). Not 5 because it states one action (hunt via taint tracking) plus a coverage list of vulnerability classes, rather than multiple distinct concrete actions like the anchor-5 example; not 3 because coverage goes well beyond 1–2 items.

Completeness

The "what" is clear and specific ("Hunt SQL injection (CWE-89) via source-level taint tracking. Covers string concat, format-string, ORM raw queries, second-order injection, and NoSQL injection…"), but the description contains no "Use when…" clause or equivalent trigger guidance — matching anchor 3 ("Has a clear 'what' but 'when' is missing"), and the rubric guideline caps completeness at 3 in that case. The trigger keywords live in a separate metadata.when_to_use field outside the evaluated description, and that field is a keyword list rather than explicit usage guidance. Not 4 because no when-clause is present in the description itself.

Trigger Term Quality

Natural terms present in the description: "SQL injection", "NoSQL injection", "MongoDB", "DynamoDB", "ORM", "CWE-89", "taint tracking" — good keyword coverage matching anchor 4. Not 5 because the very common user synonym "sqli" appears only in the metadata.when_to_use field, not in the description itself, and adjacent natural phrasings like "database query" are absent; not 3 because coverage is solidly good, not merely "some relevant keywords".

Distinctiveness Conflict Risk

Quotes: "SQL injection (CWE-89)", "source-level taint tracking", "NoSQL injection in MongoDB/DynamoDB" — a clear niche with distinct triggers and minimal conflict risk, matching anchor 5. It is highly unlikely to trigger for the wrong skill; not 4 because there is no meaningful overlap with closely related skills.