Conciseness

The body is mostly efficient (dense tables, concrete queries), but includes unnecessary explanation Claude already knows — the ASCII box defining "AST = Abstract Syntax Tree (structure)", "CFG = Control Flow Graph (execution paths)", etc. — and a Purpose paragraph that restates the frontmatter. This matches anchor 3's "mostly efficient but includes some unnecessary explanation or could be tightened"; it is not 4 because the glossary diagram and purpose paragraph are clearly trimmable padding.

Actionability

Concrete, executable guidance throughout: copy-paste CPGQL queries ("cpg.method(\"login\").callOut.code.l"), full CodeQL taint queries, MCP config JSON, and install commands ("~/.claude/install-graph-tools.sh --joern"). It falls short of anchor 5 because of minor gaps — the second CodeQL example omits its import and uses an undefined "RedirectSink" class, so it is not directly executable as written.

Workflow Clarity

The combined workflow gives a clear five-step sequence (SCOPE → STRUCTURE → FLOW → SECURITY → REPORT) with per-tier tools, and the anti-patterns table supplies checkpoints like "Always verify CPG is built and current before querying" (get_cpg_status) and "scope with Tier 1 first". Not anchor 5 because validation is stated as guidance rather than embedded as explicit validation steps in the workflow itself — minor gaps matching anchor 4.

Progressive Disclosure

The body is well-organized with clear sections (tier selection, per-tier tool tables, queries, combined workflow, anti-patterns), and no bundle files exist so all content lives inline appropriately for a ~220-line skill. It matches anchor 4's "good structure; most content is appropriately placed; minor organization gaps" — the query catalogs and MCP config snippets could arguably be split into reference files, keeping it below anchor 5.

Specificity

The description lists several concrete actions — "control flow, data flow, taint analysis, and security auditing" — and names the specific tools (Joern CPG, CodeQL). It falls short of anchor 5 because coverage has minor gaps (e.g., dead-code detection, refactoring impact, supported languages are not mentioned), matching anchor 4's "several specific actions; minor gaps in coverage".

Completeness

The "what" is clear (deep CPG analysis with Joern/CodeQL for flow and taint analysis), but the description field itself contains no "Use when..." clause or equivalent trigger guidance — the trigger guidance lives in a separate `when-to-use` frontmatter field, which per the judging guidelines caps completeness at 3 ("clear 'what' but 'when' is missing"). It is not 2 because the "what" is concrete and multi-faceted, not vague.

Trigger Term Quality

Natural trigger phrases users would say are present: "control flow", "data flow", "taint analysis", "security auditing", plus tool names "Joern" and "CodeQL". Not anchor 5 because common synonyms like "vulnerability scanning", "static analysis", or "security audit" are missing; not anchor 3 because the term coverage goes well beyond a single generic keyword.

Distinctiveness Conflict Risk

Naming "Joern CPG (AST+CFG+PDG)" and "CodeQL" carves out a clear niche with distinct triggers; these tool-specific terms are unlikely to collide with other skills. This matches anchor 5's "clear niche with distinct triggers; minimal conflict risk".