Conciseness

The body is lean: the six questions are two-to-three-line prompts with punchy, non-obvious guidance ('Logs alone are not detection', 'GDPR: 72h. HIPAA: 60d'), no padding, no explanation of concepts Claude already knows, and every section (When to Run, Questions, Workflow, Output Format, Routing) earns its tokens. Matches anchor 5 — assumes Claude's competence throughout.

Actionability

The six questions and the full output-format template are concrete and copy-paste ready, covering the common case. The gap is the Workflow section: two bare `python ../../../c-level-advisor/skills/ciso-advisor/scripts/risk_quantifier.py` invocations with no arguments, no description of what they output, and referenced files that do not exist — more than a trivial omission, but localized within otherwise executable guidance. Fits anchor 4 (mostly executable, minor-to-moderate gaps) better than anchor 3, whose guidance would be incomplete overall.

Workflow Clarity

The six questions are numbered and contain conditional gates ('If no runbook: build one before ship', 'If untested: tabletop before ship'), but the overall process is never sequenced: it is not stated when to run the two scripts, how their outputs populate the template (ALE, MTTD, compliance counts), or in what order questions, scripts, and output assembly occur. This matches anchor 3 — sequence present, checkpoints and integration missing — rather than anchor 4's clear end-to-end sequence. (This is a review skill, not a destructive/batch operation, so the destructive-cap does not apply.)

Progressive Disclosure

Good structure with well-organized sections and appropriately short inline content; the Related and Routing sections clearly signal one-level-deep references. Not a 5 because the body exceeds the simple-skill threshold and its references (workflow scripts, agent doc, related skill) use fragile three-level-up relative paths that do not resolve to real files, weakening navigation; not a 3 since nothing that belongs in a separate file is inlined and all references are clearly signaled.

Specificity

The description states one abstract action — 'Risk-paranoid interrogation of any plan that touches data, compliance, or production access' — and names the domain, but lists no concrete capabilities (e.g., STRIDE threat modeling, blast-radius/ALE quantification, runbook checks) that the body actually performs. This matches anchor 3 (domain plus 1-2 actions, not comprehensive); it lacks the several specific actions of anchor 4 and exceeds anchor 2's purely generic phrasing.

Completeness

Both what ('Risk-paranoid interrogation of any plan that touches data, compliance, or production access') and when ('Use when launching features that handle customer data, before a SOC 2 / ISO audit, or after any incident or near-miss') are explicitly present, and the when clause has three concrete triggers. Not a 5 because the 'what' is a single evocative verb phrase rather than a concrete description of the outputs (six CISO questions, threat model, ALE, ship/block verdict).

Trigger Term Quality

Good natural keyword coverage: 'plan', 'data, compliance, or production access', 'customer data', 'SOC 2 / ISO audit', 'incident or near-miss'. A few common terms users would say are missing — 'breach', 'PII/PHI', 'HIPAA/GDPR', 'security review' — so it falls between anchor 4 and anchor 5, closer to 4.

Distinctiveness Conflict Risk

The description carves a clear niche — risk/security interrogation of plans before production or audit events — with triggers unlikely to fire for unrelated skills. Minor overlap risk remains with generic incident-response or code-security-review skills, matching anchor 4 rather than the fully distinct niche of anchor 5.