Conciseness

The body is efficient — no explanations of concepts Claude already knows; every section is operational ("By default it treats these as private: .env*, *.env, .npmrc, secrets/, .ssh/, id_rsa*"). It is not a 5: a few passages pack several directives into single sentences — the IN RESULT table cell combines three instructions plus a caveat, and the final bullet of section 4 chains four clauses ("A hand-made pass sees which files a call named, but not a value printed by a search that named no file, which is the route that matters most...") — which could be split or trimmed without losing meaning. It is not a 3: there is no padding or over-explanation, only density that occasionally needs a second read.

Actionability

Everything is copy-paste executable: `npx -y @agentwhy/cli@0.4.1 check`, `start --detach --quiet`, `check --mark rotated <path>` with `--note` and `--unmark`, `init`, options `--since 30d`, `--full`, `--share`, and even the exact permission strings ("Bash(npx -y @agentwhy/cli@0.4.1 check)") to add to settings. It is not a 4: the common cases are all covered, including interpretation of each output label, the no-sessions-found case, and the command-refused path — nothing needed to execute is missing.

Workflow Clarity

The process is clearly routed by user intent (question → check, section 1; report or Codex question → page, section 2) with explicit error-recovery loops: no sessions stored → ask which folder the user worked in; command refused → section 3's two concrete remedies. Mutating operations carry a confirmation checkpoint ("Never mark a line the user has not confirmed"), and the tool's own non-destructive nature is stated ("writes nothing, and exits 0 whatever it found"). It is not a 4: validation checkpoints and failure feedback paths are explicit, not merely implied — the destructive-operation cap does not apply since the core flow is read-only.

Progressive Disclosure

A single well-sectioned file (numbered sections 1–5 plus Limits) with external detail correctly deferred rather than inlined: detection gaps point to the project's own "docs/detection.md" and the report detail to agentwhy's page. It is not a 5: at ~110 lines, the full label-interpretation table and the rules sections sit inline in SKILL.md; while defensible at this size, the table in particular is the kind of material a reference file would absorb if the skill grows. It is not a 3: structure is clear, navigation is easy, and the one external reference is clearly signaled and one level deep.

Specificity

The description lists multiple concrete actions — "Checks which private files (.env, keys, secrets) Claude Code and its subagents reached", "whether a value came into an agent's context", "which key to change, by running the open source agentwhy CLI over the session records" — with comprehensive coverage of the tool's function. It is not a 4: the action list covers detection, attribution to subagents, exposure determination, and remediation target, leaving no notable gaps, and it stays in third person ("Checks", "Runs locally and never prints").

Completeness

Both parts are explicit: the "what" ("Checks which private files ... reached, whether a value came into an agent's context, and which key to change, by running the ... CLI over the session records") and the "when" ("Use when the user asks whether the agent or a subagent read their .env or other secrets, which private files a session touched, whether a key leaked into the conversation, or which key to rotate"). It is not a 4: the "when" clause enumerates concrete trigger phrases rather than being merely present or generic.

Trigger Term Quality

Natural user phrasings with synonyms and extensions are all present: ".env", "secrets", "read their .env or other secrets", "which private files a session touched", "whether a key leaked into the conversation", "which key to rotate". It is not a 4: coverage matches the top anchor — everyday phrasings (leaked, rotate, change, touched, read) plus the concrete file extension, not just domain keywords.

Distinctiveness Conflict Risk

It occupies a clear niche — auditing private-file access in Claude Code session records — with triggers ("did the agent read my .env", "which key to rotate") no other plausible skill would claim. It is not a 4: overlap risk is minimal because the trigger set is specific to this exact audit task rather than to a broader file- or security-related family of skills.