The bulk is maximally lean payload/reference tables that earn their tokens, but the 'Operator Notes (Claude-BugHunter)' section carries self-referential padding ('verified in Phase 2H', 'this repo's 31+ skill-area live tests', 'Phase 2D's hardened lab') that Claude does not need. It is not level 3 because not every token earns its place; it is not level 1 because the core reference material is dense and free of basic-concept explanation.

The body is almost entirely copy-paste-ready payloads, curl/ffuf/hashcat commands, working Python scripts, and concrete IP-bypass encodings — fully executable, specific examples throughout. It is not level 2 because there is essentially no pseudocode or abstract 'describe-don't-instruct' content; the guidance is concrete and complete.

Several multi-step processes are sequenced (MFA bypass patterns, HTTP smuggling detection, SAML attacks) and strong validation gates exist (OOB-Or-It-Didn't-Happen, statistical sampling with t>3, 'build the chain first, confirm end-to-end, THEN report'), but these checkpoints live only in the Operator Notes rather than being woven into each per-technique workflow, so sequences present lack consistent inline checkpoints. It is not level 3 because validation is not uniformly integrated per workflow; it is not level 1 because explicit checkpoints and a reporting checklist do exist.

The file is a single ~900-line monolith with no references/, scripts/, or assets/ bundle files; content that could be split into per-vuln-class reference files is all inline, though it is well-organized with clear section headers and a clearly-signaled 'Related Skills & Chains' navigation block. It is not level 3 because there are no one-level-deep reference files offloading detail; it is not level 1 because organization is good and references are not deeply nested.

The description enumerates multiple concrete deliverables — 'Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table' — listing specific concrete contents rather than vague actions, matching the level-3 anchor 'Lists multiple specific concrete actions.' It is not level 2 because it goes well beyond naming a domain plus some actions into a comprehensive, itemized inventory.

It explicitly answers both 'what' (the arsenal contents) and 'when' via an explicit 'Use when you need specific payloads for...' clause, satisfying the level-3 anchor. It is not capped at 2 because the trigger guidance is explicit, not merely implied.

The 'Use when' clause surfaces the natural vuln-class terms a tester would actually say — 'XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques' — giving good coverage of natural trigger terms. It is not level 2 because it lists the full spread of common variations rather than only a few relevant keywords.

The niche is sharply defined as an offensive-security payload library and it even disambiguates ownership ('Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation'), making conflict with sibling skills unlikely. It is not level 2 because the scoped triggers and explicit boundary-setting clearly separate it from adjacent skills.