Conciseness

Mostly dense, non-obvious domain guidance Claude does not already have ("1x non-participating is standard; 1x participating or 2x is hostile"; "5-year auto-renew with 60-day notice is a common founder mistake") with no padding explaining known concepts. Not 5 because the ~40-item "## Keywords" section and the "Version / Status / Disclaimer" footer duplicate the frontmatter description, triggers, and metadata, and the version/status footer is time-sensitive boilerplate outside any deprecated section.

Actionability

Concrete commands are specified ("python scripts/contract_risk_scanner.py path/to/contract.txt", "Run term_sheet_analyzer.py to get a 0-100 founder-friendliness score"), but neither script exists in the bundle — references/, scripts/, and assets/ are absent entirely — and the detailed checklists and glossaries are deferred to three references/*.md files that are also missing. Not 4 because missing tooling and missing referenced detail are more than minor gaps; not 2 because the body itself still supplies specific steps, negotiation standards, and a regulatory trigger table.

Workflow Clarity

Four workflows are clearly numbered and sequenced ("1. Save the contract as plain text 2. Run contract_risk_scanner.py... 3. For each HIGH risk finding, draft a counter-proposal"), but no validation or verification checkpoints appear anywhere, and the batch IP Hygiene Audit ("Confirm every employee and contractor (past 12 months) signed invention assignment") has no verification step — the batch-operation cap of 3 applies. Steps also depend on scripts and "/cs:decide" / "/cs:freeze" commands not present in this bundle.

Progressive Disclosure

Sections are well organized and references are clearly signaled ("See references/ip_and_regulatory.md"; a dedicated References section with one-line descriptions), but scored against the actual bundle structure, none of the five referenced files exist — both scripts and all three reference docs are absent, so every path to deeper material dead-ends like the bad "See advanced.md for more details" example. The disclosure structure is non-functional as shipped; not 3 because the failure is not mere organization but a completely empty referenced layer.

Specificity

Names multiple concrete capabilities with named artifacts — "contract review (MSA, SaaS, NDA, DPA, employment), IP strategy, term sheet decoding, and regulatory landscape mapping" — matching the comprehensive multi-action anchor like the PDF example ("Extract text and tables from PDF files, fill forms, merge documents"). Not 4 because coverage spans the skill's full scope with concrete named contract types and regimes rather than showing gaps.

Completeness

Explicitly answers both questions: what — "General Counsel advisory for startups: contract review (...), IP strategy, term sheet decoding, and regulatory landscape mapping"; when — "Use when reviewing any contract or term sheet... or when user mentions general counsel, GC, legal review...". This matches the 5 anchor's structure exactly, and adds a scope boundary ("NOT a substitute for licensed counsel").

Trigger Term Quality

Trigger coverage is synonym-rich and natural: "Use when reviewing any contract or term sheet, deciding when to engage outside counsel, defining IP strategy, evaluating regulatory exposure (HIPAA, GDPR, FDA, fintech), or when user mentions general counsel, GC, legal review, contract risk, term sheet, IP assignment, or regulatory exposure". Both contextual triggers and explicit keyword triggers ("GC" alongside "general counsel") are present; no file-extension terms apply to this domain, so nothing natural is missing.

Distinctiveness Conflict Risk

Clear niche ("General Counsel advisory for startups") with distinct triggers (GC, term sheet, IP assignment, liquidation-preference vocabulary), but "evaluating regulatory exposure (HIPAA, GDPR, FDA, fintech)" overlaps with privacy/compliance/security skills that share those regime triggers — minor overlap risk with closely related skills rather than minimal. Not 5 because a user asking about GDPR or HIPAA compliance could reasonably route to either this or a privacy/CISO skill; not 3 since the dominant triggers are unmistakably legal/GC.