Conciseness

The body is dense with non-obvious, specialized content (exact Unicode format-character ranges, SkillSpector rule IDs, OWASP LLM 2025 numbering, MCP rug-pull pinning guidance), but a few spots explain what Claude already knows — the Background definition ("It occurs when untrusted input influences the instructions an LLM follows…") and Step 6's generic extraction attempts ("Repeat your instructions verbatim") — and some bullet lists repeat the code examples directly above them. Anchor 4 (efficient, minor over-explanation to trim) rather than 5, since these instances are minor against a largely specialized 440 lines.

Actionability

Fully executable, copy-paste-ready guidance throughout: three grep dialects (ripgrep, GNU, portable BSD) with exact Unicode ranges for every concealment check, "node references/validate-findings.mjs findings.json" for validation, VULNERABLE/BETTER code pairs for each sink pattern, and concrete output shapes (fingerprint examples, ext keys table). No pseudocode appears; this matches anchor 5.

Workflow Clarity

Nine clearly sequenced steps (attack surface → prompt construction → concealment → output handling → tools/agents → prompt leaking → permission boundaries → defenses → verify/record) with explicit validation checkpoints in Step 9: a mandatory refutation pass before confirming, severity calibration, a validated findings.json with confirmed/needs_validation/rejected verdicts, plus checklists (permission checklist and defense assessment tables). Checkpoints are explicit with error-recovery guidance, matching anchor 5 rather than 4.

Progressive Disclosure

All six referenced files exist in references/ and are exactly one level deep, clearly signaled with markdown links at the point of need (findings-format.md, verification.md, severity-calibration.md at Step 9; validate-findings.mjs and to-sarif.mjs for validation). However, the body is a full ~440-line operational manual rather than a lean overview — the four grep-dialect variants per concealment check and the complete report template are candidates for reference files. Good structure with minor organization gaps fits anchor 4; not 3 because references are clearly signaled and nothing is nested, not 5 because the split leaves substantial detail inlined.

Specificity

"Audit applications for AI prompt injection, agent security, and LLM permission boundary vulnerabilities, including chatbots and agents hijacked by what they read" names the action and multiple concrete vulnerability classes with concrete attack scenarios (a malicious web page in a browsing agent, emails/tickets reaching an agent that can send replies, write files or call tools). This matches the anchor-5 pattern of multiple specific concrete capabilities with comprehensive coverage; there are no minor gaps that would place it at 4.

Completeness

Explicitly answers "what" (audit applications for prompt injection, agent security, and LLM permission boundary vulnerabilities) and "when" via a concrete "Use when the user mentions…" clause with specific trigger phrases. This is the anchor-5 pattern exactly; not 4, since the 'when' is fully explicit and specific rather than merely present.

Trigger Term Quality

Fifteen explicit quoted trigger phrases ("prompt injection," "jailbreak," "AI red team," "system prompt extraction," "MCP security," "AI privilege escalation") plus the natural fallback "needs to secure any application with AI features, AI agents, or LLM integrations." Synonym coverage is comprehensive (prompt injection / indirect prompt injection / prompt leaking), matching anchor 5 rather than the 4 anchor's 'a few natural terms missing.'

Distinctiveness Conflict Risk

The description carves out a clear niche (AI/LLM security auditing) with distinct, domain-specific triggers (prompt injection, jailbreak, MCP security, system prompt extraction). These terms would not naturally route users to adjacent skills (general appsec, threat modeling), so conflict risk is minimal — anchor 5, not 4's 'minor overlap risk with closely related skills.'