A lean operational runbook using tables, command blocks, and terse directives ('Capture pentestId', 'Do not poll faster'); nearly every token earns its place and it avoids teaching concepts Claude already knows. The few explanatory lines (pentest duration, role scope) are operationally necessary context, not padding, so it stays at the 'lean and efficient' anchor rather than the 'mostly efficient but could be tightened' score 2.

Provides fully executable `aws securityagent ...` commands with real flags, a placeholder-resolution table, concrete JSON shapes for state persistence, exact polling intervals, and precise file paths — copy-paste ready rather than pseudocode.

A clearly numbered Register→Create→Start→Poll→Findings→Stop sequence with explicit validation checkpoints for an active/destructive operation: authorization confirmation, agent-space existence check, domain-verification prerequisite, terminal-state polling handling, and 'show the failure first' error recovery. Validation is present (not missing), so it is not capped at 2.

No bundle files exist; the body appropriately delegates setup to a separate `setup-security-agent` skill and external `.security-agent/*.json` state, and is organized into clear, self-contained sections with no content that needs splitting — matching the 'well-organized, single-file' allowance for the 'clear overview' anchor.

Names multiple concrete actions — 'registers and verifies the target domain', 'exercises the supplied endpoints with the managed Security Agent service', and 'returns verified runtime findings' — matching the 'lists multiple specific concrete actions' anchor rather than the narrower score-2 'names domain and some actions'.

Explicitly answers both what (the concrete actions) and when via a 'Use when...' clause listing multiple triggers, matching the 'clearly answers both what AND when' anchor.

Covers natural user phrasings — 'pentest', 'run a penetration test', "test their app's attack surface", 'find runtime vulnerabilities', 'register or verify a target domain', 'check pentest status / findings' — broad coverage of what a user would actually say.

Carves a clear niche (AWS Security Agent pentest against a live web app) with distinct triggers unlikely to collide with generic code-scan or document skills.