Conciseness

Largely lean with concrete payloads and minimal preamble, but the Jinja2 RCE payload ('{{config.__class__.__init__.__globals__[\'os\'].popen(\'id\').read()}}') is repeated across the priority, RCE-payload, and related-skills sections, and the Related Skills block re-states chain primitives. It is not the 5 anchor because not every token earns its place; not the 3 anchor because the prose is mostly tight and assumes competence.

Actionability

Copy-paste-ready payloads for Jinja2, Twig, ERB, and Freemarker, plus concrete protocol guidance (Content-Type: application/x-www-form-urlencoded, keeping the id as a query param, csrf/template/template-action body fields). Specific examples cover the common engine cases. Not the 4 anchor because guidance is fully executable with the key request-shape details filled in.

Workflow Clarity

The 'Order of attack' gives a clear numbered escalation sequence, and the CMS section includes an explicit feedback loop ('Re-fetch the CSRF each time and use preview to iterate') with a validation checkpoint ('Proof: Command output ... confirms RCE'). The destructive-RCE validation cap does not apply because proof steps are present. Not the 4 anchor because both a sequence and error-recovery feedback loop are explicit.

Progressive Disclosure

Well-organized with clear section headers and no nested references, and the Related Skills section clearly signals sibling skills. It is not the 5 anchor because the content is a self-contained ~100-line body with no one-level-deep bundle references (references/, scripts/, assets/ are absent), and the engine payload matrices / WAF-bypass variants are inlined rather than split into reference files. Not the 3 anchor because structure and signaling are good, not merely present.

Specificity

Lists multiple concrete actions — detection probes ('double-curly and dollar-curly math expressions'), engine fingerprinting, and RCE escalation via named patterns ('class-walker, callback-registrar, or Execute-utility') — with comprehensive engine coverage. It is not the 4 anchor because coverage spans detect→fingerprint→escalate rather than having minor gaps.

Completeness

Explicitly answers both 'what' (hunt/detect/fingerprint/escalate SSTI across engines) and 'when' with concrete trigger phrases ('Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render'). Not the 4 anchor because the 'when' clause gives multiple specific triggers rather than one that could be more explicit.

Trigger Term Quality

Comprehensive natural terms for the skill's audience — 'template injection', 'SSTI', 'RCE', plus engine/framework synonyms (Jinja2/Flask/Django, Twig/Symfony, Freemarker/Java, ERB/Rails) and concrete targets ('email templates', 'PDF/report generators', 'CMS preview features'). Not the 4 anchor because synonyms are covered broadly rather than missing a few.

Distinctiveness Conflict Risk

Occupies a clear niche (server-side template injection with engine-specific payloads) with distinct triggers unlikely to fire for unrelated skills. Not the 4 anchor because overlap risk with sibling hunting skills is minimal — the template-engine framing is uniquely identifying.