Conciseness

The body is lean and assumes Claude's competence — it never explains what SOC 2, GDPR, or a DPA is, and every line carries non-generic specifics Claude cannot reliably reproduce from memory (exact control/article citations like 'Annex A 5.19' and 'Art. 28(3)', dated facts like the Nov 18 2025 CTPP list, and case studies like Salesloft Drift Aug 2025). The embedded dates are currency anchors for regulatory facts rather than deprecated-pattern branching, and the 'Last verified: 2026-09-14' header makes staleness auditable, so the time-sensitivity penalty does not bite; anchor 4 ('minor instances of over-explanation') fits worse since nothing reads as trimmable padding.

Actionability

Per the code-vs-instruction scoring note, absence of code is not penalized, and the guidance is maximally concrete: the SOC 2 workflow specifies ordered checks ('check the OPINION first... then the period'), the Art. 28(3) checklist enumerates every clause topic (documented instructions, confidentiality, Art. 32 security, breach notification, deletion/return, audit rights), the questionnaire workflow dictates the exact output form ('domain-organised, yes/no + evidence request per question'), and the response table defines a concrete output format per task type. Anchor 4 ('minor gaps') fits worse — specific examples cover the common cases across all six workflows.

Workflow Clarity

The lifecycle sequence (Planning → Due diligence → Contract negotiation → Ongoing monitoring → Termination) frames the body, and each workflow has clear internal sequencing with conditional branches ('if the period ended months ago, request a bridge letter') plus checklists (offboarding checklist, answer-completeness rules acting as a final QA gate). However, the offboarding workflow involves destructive steps (access/token/OAuth revocation, data deletion) and its validation is only implicit — 'data return + certified deletion' and 'lessons-learned' are present, but there is no explicit step to verify each revocation took effect or that the deletion certificate was received before closing out the vendor. That is exactly the 'clear sequence with most checkpoints present; minor validation gaps' anchor-4 fit, below anchor 5's 'explicit validation steps with feedback loops'.

Progressive Disclosure

The body is a genuine overview with a well-signaled Reference Files section — all four listed files exist, match their one-line descriptions, and are exactly one level deep (no nested references inside them), with detail appropriately split out. The gap keeping it from anchor 5: references are only listed in a terminal section rather than linked inline from the workflows they extend — e.g., the SOC 2 section never points to 'references/soc2-report-review.md' mid-workflow, so navigation relies on the reader connecting the end-of-file list to the right section. That is the 'references mostly clear; minor organization gaps' anchor-4 fit.

Specificity

The description enumerates multiple concrete actions covering the full lifecycle — 'risk-based vendor tiering, tailored due-diligence questionnaires... SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda... ongoing monitoring programmes, and vendor offboarding' — comprehensive coverage with sub-details for each action. Score 4 ('minor gaps in coverage') is ruled out because the lifecycle span is complete from tiering through offboarding with no missing major capability.

Completeness

Both 'what' and 'when' are explicit: the what is the full action list above, and the when is the explicit 'Use this skill whenever a user mentions...' clause with concrete trigger phrases. This matches the anchor-5 example structure exactly; anchor 4 ('when' could be more explicit) does not apply because the trigger clause lists specific phrases users would say.

Trigger Term Quality

Trigger coverage is comprehensive and natural: 'vendor risk, supplier due diligence, third-party assessments, security questionnaires, reviewing a vendor's SOC 2 report, vendor tiering, fourth parties or sub-processors, supply chain security requirements, DORA ICT third-party rules, business associate agreements, or exit/termination of a vendor', plus quoted request phrasings ('a customer sent us a questionnaire', 'how do I assess this vendor'). It includes the vendor/supplier/third-party synonyms users actually say, matching the anchor-5 standard of comprehensive natural-term coverage; score 4 ('a few natural terms missing') fits worse since even request-style phrasings are covered.

Distinctiveness Conflict Risk

A clear niche (third-party risk management) with distinct domain-specific triggers (SOC 2 report review, DPA sub-processors, BAA, DORA Art. 30) unlikely to fire for unrelated skills. Score 4 ('minor overlap risk with closely related skills') is considered, but the triggers are anchored in TPRM-specific vocabulary that generic compliance/security skills would not claim.