Conciseness

The body is lean and assumes Claude's competence throughout: no explanation of what WPA2 is, how monitor mode works, or what hashcat does. Every section (two capture paths, vendor table, evidence, ZFP, OPSEC) earns its place. Not 4: there is no over-explanation to trim.

Actionability

Fully executable, copy-paste-ready commands with real flags on both paths ("hcxdumptool -i <mon-iface> --enable_status=1 -w /tmp/pmkid.pcapng --filterlist_ap=... --filtermode=2", "hashcat -m 22000", "aireplay-ng --deauth 1 -a <BSSID> -c <CLIENT_MAC>") plus a concrete kg_add_node evidence example and a vendor generator table. Not 4: common cases and fallbacks are covered, so there are no minor gaps.

Workflow Clarity

Both paths are clearly sequenced with explicit validation checkpoints ("Confirm WPA handshake in airodump's header line", "hashcat --show line proving the PSK matches the hash") and feedback loops for error recovery ("If PMKID is empty... Fall back to Path B"; 802.11w/PMF rejection → "mark the BSSID as deferred and move on"). Not 4: validation is explicit, not implied, and failure recovery is fully specified.

Progressive Disclosure

Sections are well organized and the References section signals two one-level-deep files with clear descriptions, but both referenced files ("references/vendor-generators.md", "references/wpa3-transition-mode-notes.md") are absent from the bundle — the references/ directory does not exist. Not 4: this is more than a minor organization gap, since following either reference fails; not 2 because the inline content is appropriately scoped and the references are clearly signaled, just dangling.

Specificity

The description lists multiple concrete actions covering the full capability: "handshake capture via targeted deauth", "PMKID (no deauth required)", and "offline hashcat cracking" — both acquisition paths plus cracking. It is not 4 because there are no meaningful coverage gaps; every capability is named specifically with no vague filler.

Completeness

The "what" is explicit and clear (capture handshake/PMKID, crack offline with hashcat), but there is no "Use when..." clause or equivalent trigger guidance — the "when" is only weakly implied by naming the encryption mode. Per the rubric guideline, a missing explicit 'when' caps completeness at 3; not 4 because the second sentence ("The most common consumer/SMB encryption mode in 2026") is context, not a trigger.

Trigger Term Quality

Good natural keyword coverage: "WPA/WPA2-PSK", "handshake capture", "deauth", "PMKID", "hashcat cracking". Not 5 because common user phrasings like "wifi password" / "wireless" / "crack wifi" are absent, leaving a few natural synonyms and variations missing.

Distinctiveness Conflict Risk

Clear niche with distinct triggers (WPA/WPA2-PSK, PMKID, hashcat) and minimal conflict risk — even a sibling WPA3/SAE skill would trigger on different terms. Not 4: the domain scoping is explicit and the trigger terms are unambiguous.