Conciseness

The body is lean and list-driven with almost no explanation of concepts Claude already knows, but a few tokens could be trimmed — the opening sentence ('Systematically gather, analyze, and correlate publicly available information from open sources') restates the frontmatter description, and some source-name lists (Shodan, Censys, VirusTotal) add little beyond names. It is not 5 because not every token earns its place, and not 3 because the padding is minor.

Actionability

It gives copy-paste-ready commands for whois, dig, the crt.sh curl|jq pipeline, exiftool, and concrete Google dork syntaxes, plus a full markdown report template. However, the Organization, Email/Username, and Threat Intelligence sections are bare source lists with no executable how-to, which keeps it below the 'fully executable, covers common cases' anchor.

Workflow Clarity

The section ordering forms a clear sequence (Authorization check → Collection → Analysis → Output) and includes real validation checkpoints (four-point authorization checklist, 'validate information with at least two independent sources', confidence rating with defined High/Medium/Low levels). It is not 5 because the sequence is implied by section order rather than explicitly enumerated as steps with feedback loops.

Progressive Disclosure

As a single-file skill with no bundle files, everything lives in SKILL.md at an appropriate overview altitude with clear, navigable section headers and no nested references. It is not 5 because at ~120 lines with five collection subsections, per-technique detail (e.g., a source-by-source playbook) is at the boundary of what could be split into reference files, leaving minor organization headroom.

Specificity

The description names the domain and two concrete actions ('Gather and correlate open source intelligence from public sources') but does not enumerate specific sub-capabilities such as infrastructure mapping, breach exposure checks, or document metadata analysis, matching the '1-2 concrete actions, not comprehensive' anchor rather than the 'several specific actions' anchor.

Completeness

It explicitly answers both 'what' (gathering and correlating open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment) and 'when' (a concrete 'Use when the user mentions...' clause with specific trigger phrases), matching the top anchor exactly. It is not score 4 because the 'when' is already fully explicit with concrete triggers.

Trigger Term Quality

It provides comprehensive natural trigger coverage including the essential synonym pair ('OSINT', 'open source intelligence') plus 'digital footprint', 'public records', 'threat intelligence', 'investigate a domain', and a situational clause ('needs to research a target using publicly available data'); no common natural variation for this domain is missing.

Distinctiveness Conflict Risk

'OSINT' is a clear niche trigger, but 'investigate a domain' and 'threat intelligence' create minor overlap risk with closely related recon and threat-intel skills, fitting 'mostly distinct; minor overlap risk' rather than anchor 5's 'minimal conflict risk'.