Conciseness

The body is almost entirely operational — payload code blocks, executable grep commands, and impact/CVSS tables with no padding. The 3-sentence intro conveys non-obvious prioritization ("the highest-yield reconnaissance step on any LLM engagement — do it before anything else") rather than explaining concepts Claude already knows, matching the lean anchor 5.

Actionability

Fully executable, copy-paste-ready payloads across the common cases (verbatim repeat, token-by-token slices, roleplay, reversed-word and base64 encodings, tool-argument reflection, indirect document injection) plus runnable grep commands for source auditing. Specific examples cover the common cases, matching anchor 5.

Workflow Clarity

Numbered sections 1-8 form a clear sequence (recognize -> attack vectors -> source audit -> exploitation goals -> PoC -> validate -> CVSS -> chain promotion), with contingency branching ("If the model refuses bulk extraction, ask for tiny slices"; "Useful additions for hardened defenders") and an explicit validation contract in section 6 with negative command and negative patterns. Validation checkpoints and feedback paths are present, matching anchor 5.

Progressive Disclosure

Well-organized single-file skill with clearly headed sections, tables, and code fences — no buried or nested references, easy to navigate. However, all ~150 lines are inlined in SKILL.md with no bundle files; the payload variant library and CVSS tables could be split into reference files, and the over-50-line simple-skill exception for scoring 5 does not apply. Good structure with minor organization gaps, matching anchor 4.

Specificity

"Hunt LLM system-prompt leakage (OWASP LLM07:2025) — exfiltration of the privileged system prompt revealing internal rules, secrets baked in, tool inventory, and business logic" names the domain, a concrete action, and enumerates specific leak targets. It falls between anchor 3 (1-2 concrete actions) and anchor 5 (multiple distinct actions), since it describes one action class with a detailed list of disclosed contents — noticeably above the midpoint, so 4.

Completeness

The "what" is clear (hunt/exfiltrate the privileged system prompt to reveal internal rules, secrets, tool inventory, business logic), but the description field itself contains no "Use when..." clause or equivalent explicit trigger guidance — the trigger keywords live only in a metadata.when_to_use string, not the description. Per the guideline, a missing explicit "when" in the description caps completeness at 3.

Trigger Term Quality

Includes natural niche terms users would say — "system-prompt leakage", "exfiltration", "OWASP LLM07", "tool inventory", "client-visible" — giving good keyword coverage. A few natural synonyms are missing (e.g. "prompt extraction", "reveal initial instructions", "dump instructions"), matching anchor 4 rather than the comprehensive synonym coverage of anchor 5.

Distinctiveness Conflict Risk

"LLM system-prompt leakage (OWASP LLM07:2025)" carves out a clear niche with distinct triggers (leakage/exfiltration of the system prompt) that would not fire for sibling OWASP LLM finding types like prompt injection (LLM01) or excessive agency (LLM06); minimal conflict risk, matching anchor 5.