Conciseness

The core sections are lean and provider-specific ("used as a plain string. Do not hex-decode it", "Never JSON.parse / re-serialise first"), with no explanations of concepts Claude already knows, so it is above the 3 anchor; it misses the 5 anchor because the 'Important Headers' table restates the signing rules bullets from 'Essential Code' and the 9-link 'Related Skills' section plus 'Attribution' are tokens that could be trimmed.

Actionability

Verification is fully executable and copy-paste ready in both Node.js and Python (input validation, timing-safe comparison, the express.raw hint) plus an executable tunnel command ("npx hookdeck-cli listen 3000 affonso --path /webhooks/affonso"), matching the 4 anchor's 'concrete code or commands with minor gaps'; the gap that keeps it from 5 is that 'complete handlers with tests' are promised at examples/express/, examples/nextjs/, and examples/fastapi/, which do not exist in this bundle.

Workflow Clarity

There is an explicit validation checkpoint with failure behavior ("Respond 401 when verification fails (missing or empty header, malformed digest, mismatch)") and raw-body acquisition warnings, plus idempotency guidance ("Use the event id for idempotency instead"), placing it above the 3 anchor; it falls short of the 5 anchor because the end-to-end handler sequence (verify first, parse second, handle idempotently) is only available via external webhook-handler-patterns links rather than an inline sequence.

Progressive Disclosure

The three referenced files (references/overview.md, references/setup.md, references/verification.md) all exist, are one level deep, and are clearly signaled with descriptions in the 'Reference Materials' section, with common events inline and the full list delegated — good structure per the 4 anchor; it is not 5 because the body's links to examples/express/, examples/nextjs/, and examples/fastapi/ point to directories absent from the bundle, a navigation gap for the most substantial promised resource.

Specificity

Concrete actions are named — "Receive and verify Affonso affiliate-program webhooks", "setting up Affonso webhook handlers", "debugging X-Affonso-Signature verification" — matching the 4 anchor ('several specific actions; minor gaps') rather than the 5 anchor, since the core capability list is two actions (receive, verify) plus triggers, not the comprehensive multi-action coverage of the 5 example.

Completeness

It clearly answers 'what' ("Receive and verify Affonso affiliate-program webhooks") and 'when' with an explicit "Use when setting up... debugging... or handling events like..." clause listing three concrete trigger scenarios, structurally matching the 5 anchor example; the 4 anchor's 'when could be more explicit' does not apply since the triggers name specific tasks and events.

Trigger Term Quality

Natural phrases users would say are present — "Affonso webhook handlers", "X-Affonso-Signature verification", and five concrete event names ("affiliate.created", "payout.paid") — giving good keyword coverage; it falls short of the 5 anchor because synonyms like "Affonso integration", "webhook secret", or "commissions/payouts" are missing, and it is well above the 3 anchor's 'some relevant keywords' since the specific header and event names are included.

Distinctiveness Conflict Risk

The vendor-specific niche ("Affonso", "X-Affonso-Signature", named events like "referral.converted") gives distinct triggers with minimal conflict risk against the many other webhook skills; every trigger term contains 'Affonso', so the 4 anchor's 'minor overlap risk with closely related skills' is not present.