Conciseness

At ~30 lines with no filler and no explanations of concepts Claude already knows, the body is efficient — the masking format with concrete examples ('[REDACTED:API_KEY]', '[REDACTED:PASSWORD]') earns its tokens. It falls short of 5 because step 5 ('NEVER output, echo, print, log, summarize, or reference...') and the coding section's first bullet largely restate step 1's prohibition list, and the redundant DO/NEVER lists could be collapsed.

Actionability

The masking rule is concrete and executable ('MASK immediately using `[REDACTED:<type>]`' with two worked examples), and the approval condition ('MUST ask explicit user approval first') is a clear directive. But several directives are vague: 'report without exposing raw value' (report what, where?), 'Identify and apply respective guidance for handling data like that', and 'Guide user for correct implementation' give no specific steps, matching anchor 3 ('some concrete guidance but incomplete... missing key details').

Workflow Clarity

The process section lists steps with conditionals ('IF encountered', 'IF needed as-is'), but the sequence is not operationally ordered — masking (step 6) is the action that must happen before reporting (step 2) or asking approval (step 3) makes sense, and step 5 restates the prohibition instead of advancing the flow. There is also no verification checkpoint (e.g., 'confirm the response contains no raw values before sending'), so it sits at anchor 3 ('steps listed but validation gaps; checkpoints missing or implicit') rather than 4.

Progressive Disclosure

Per the rubric's guideline for skills under 50 lines with no need for external references, this qualifies for a 5 with just well-organized sections. The body is short, single-purpose, split into three clearly delimited sections (process, coding, pitfalls), with no bundle files needed and no content that belongs in a separate reference.

Specificity

The description names no concrete actions at all — it only states when to activate ("MUST activate when you suspect...") and enumerates data categories (PII, PCI, HIPAA, secrets, API keys), which is domain naming without any capability statement. It would score 2 ('Names the domain but actions are minimal or generic'), but the second-person phrasing ('when you suspect', 'are about to output') triggers the mandatory 1-point reduction, giving 1.

Completeness

The 'when' is explicitly and thoroughly covered ('MUST activate when you suspect, there is a slight chance, encounter, read, process, or are about to output any sensitive or possibly sensitive data'), but the 'what' is entirely absent — nothing says what the skill actually does (mask, redact, request approval). This matches anchor 2: 'only "when" is present without "what"'. It is not 3 because 'Rosetta CRITICAL MUST skill' is not a clear capability statement, and not 4-5 because no 'what' exists at any level.

Trigger Term Quality

Good keyword coverage with many natural terms users would say: 'PII, PCI, HIPAA, PHI, GDPR, SOC2, FedRAMP, secrets, API keys, passwords, credentials, tokens, certificates'. Not a 5 because common natural phrasings like 'personal data', 'private information', or 'confidential data' are missing, and the leading jargon ('Rosetta CRITICAL MUST skill', 'there is a slight chance') is not user language.

Distinctiveness Conflict Risk

The scope is deliberately maximal — 'any sensitive or possibly sensitive data', 'any data that could potentially be sensitive', plus 'Applicable for coding too' — so it would trigger for nearly every data-handling task, creating high overlap with most other skills. It is not 1 because it does at least anchor to a recognizable domain (sensitive-data handling) rather than being content-free like 'Helps with code and documents'.