Lean router body that assumes Claude's competence — no padding explaining what DDoS or Shield is; every section (routing table, routing notes, logging, security) carries decision guidance Claude could not derive, with concrete identifiers earning their tokens. Not the 2 anchor because there is no unnecessary explanation to tighten.

Concrete and executable guidance throughout: 'pass --region us-east-1 on every aws shield command', the AWSManagedRulesAntiDDoSRuleSet managed rule group, 'disassociate-drt-role', and an 'aws:SourceAccount' trust-policy condition, plus an explicit goal→reference routing table; instruction-only but specific, so it meets the 3 anchor rather than the pseudocode/incomplete 2 anchor.

The routing workflow is unambiguous with explicit precedence ('Decide before you subscribe', 'Subscribe and protect comes first', 'Run the subscribing reference before any of the others if the customer is starting from scratch') and a clear single action (pick the matching reference, read it in full before acting); validation for risky operations correctly lives in the references, so it clears the 3 anchor for a router skill rather than capping at 2.

Textbook one-level-deep structure: a concise overview plus a routing table linking to seven real, verified reference files (all confirmed present in references/), with details split out rather than inlined; matches the 'clear overview with well-signaled one-level-deep references' anchor and is not the 2 anchor because nothing that should be separate is inline.

Lists many concrete actions — 'subscribing accounts and adding resource protections', 'enabling automatic application layer (layer 7) mitigation through AWS WAF', 'configuring health-based detection with Route 53 health checks', 'setting up SRT access and proactive engagement', 'reviewing DDoS events and requesting cost protection credits', 'aggregating resources into protection groups' — matching the multi-action anchor; not the 2 anchor because it is comprehensive, not partial.

Explicitly answers both what (the enumerated capabilities) and when via the 'Applicable when the user wants...' clause, and adds an explicit 'Not applicable for...' boundary; clearly above the 2 anchor where the when clause is missing or only implied.

Natural trigger phrases users would say ('wants stronger DDoS protection', 'wants expert help during an attack', 'wants to recover attack-driven scaling charges') plus concrete resource keywords (CloudFront, Load Balancers, Elastic IP addresses, Global Accelerator, Route 53 hosted zones); broader and more natural than the 2 anchor's single 'Works with PDF files'.

Narrow Shield Advanced niche with explicit de-confliction against the waf, route53, and firewallmanager skills; unlikely to trigger for the wrong skill, matching the 'clear niche with distinct triggers' anchor.