Conciseness

The body is dense and efficient — tables, numbered workflows, and templates instead of prose, with no explanation of concepts Claude already knows. Minor trimmable padding keeps it below the top anchor: the opening line 'Internal and external ISMS audit management for ISO 27001 compliance verification...' duplicates the frontmatter description, and the 'Audit Performance Metrics' KPI table is peripheral to executing audits. It is above anchor 3 because there is no genuinely unnecessary explanation or slack to tighten beyond those two spots.

Actionability

Concrete, executable guidance throughout: copy-paste script commands ('python scripts/isms_audit_scheduler.py --year 2025 --output audit_plan.json'), a fill-in finding documentation template with placeholders, severity/response-time classification tables, and Stage 1/Stage 2 checklists. It falls short of anchor 5 only because no worked example (e.g., one completed finding or a sample control test result) demonstrates the common case; it is well above anchor 3 since everything given is directly usable rather than pseudocode.

Workflow Clarity

Every multi-step workflow (annual planning, pre-audit, audit conduct, control testing, corrective action) is a numbered sequence ending in an explicit bolded validation checkpoint — 'Validation: Audit plan covers all Annex A controls within certification cycle', 'Validation: All controls in scope assessed with documented evidence', 'Validation: Root cause addressed, recurrence prevented' — plus checklists for Stage 1/Stage 2 and a verify-effectiveness feedback step in the corrective action loop. This matches the top anchor: clear sequencing, explicit validation, feedback, and checklists.

Progressive Disclosure

The body is a well-organized overview with one-level-deep references that all exist in the bundle (references/iso27001-audit-methodology.md, security-control-testing.md, cloud-security-audit.md), an in-context pointer at the Control Assessment section, and a real script table entry. It misses anchor 5 because references/iso27001_audit_playbook.md exists in the bundle but is not listed in the References table or linked anywhere, so one reference file is undiscoverable from SKILL.md — a minor organization gap rather than the buried-structure problems of anchor 3.

Specificity

The description lists multiple concrete actions — 'review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows' — giving comprehensive coverage of the ISMS audit domain in third-person voice ('Helps review...'). It matches the anchor for multiple specific concrete actions with comprehensive coverage, and there is no lower anchor that fits since the actions are neither minimal nor generic.

Completeness

It clearly answers both questions: the 'what' is the opening capability statement plus the seven concrete actions, and the 'when' is an explicit 'Use when the user mentions...' clause with concrete trigger phrases. This mirrors the anchor-5 example structure ('Extract text and tables... Use when working with...') exactly; the anchor-4 case ('when' could be more explicit) does not apply since the when-clause lists nine specific triggers.

Trigger Term Quality

The 'Use when' clause enumerates natural phrases a user would actually say: 'ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation', including the spelled-out SOA synonym. Coverage of the domain's natural vocabulary is comprehensive, so it fits the top anchor rather than the 'a few natural terms missing' anchor below.

Distinctiveness Conflict Risk

The niche (ISO 27001 ISMS auditing and certification) is clear and the triggers — 'Annex A controls', 'Statement of Applicability (SOA)', 'surveillance audit' — are distinct to this domain, giving minimal conflict risk with generic security or document skills. It is not the anchor-4 case because the terms are not merely 'mostly distinct'; they are specific to ISO 27001 audit practice.