Conciseness

Nearly every sentence carries a non-obvious, provider-specific fact ("signs the raw request body bytes only — no timestamp, no delivery id", "`job-completed`... no `error`", "GitLab and GitHub App pipelines carry `pipeline.trigger_parameters`... and have no `vcs`") with zero explanation of concepts Claude already knows. Not 5 because of trimmable redundancy: the Circle-vs-CircleCI disambiguation appears three times (description, opening blockquote, and again in Related Skills), and the 12-item Related Skills list with per-item annotations is padding relative to the anchor of every token earning its place.

Actionability

Two complete, copy-paste-ready verification implementations (Node and Python) with fail-closed guards, first-`=` parsing, and timing-safe comparison; four known-answer test vectors to validate an implementation; a concrete env var and a runnable local-test command ("npx hookdeck-cli listen 3000 circleci --path /webhooks/circleci"). This fully matches the anchor of executable, copy-paste-ready code covering the common cases; there is no vague or pseudocode guidance anywhere.

Workflow Clarity

The single core action is unambiguous and fully sequenced: the verification procedure is embodied in executable code with explicit fail-closed rules ("reject if there is no `v1` entry"), the handler order is stated directly ("Verify, enqueue, respond — do the work afterwards"), and validation checkpoints are explicit — known-answer test vectors, the end-to-end Local Development flow ending in the "Test Ping Event" button, and error-recovery guidance ("Guard the lengths first (or try/catch), otherwise a truncated signature becomes a 500"). Under the simple-skill exception this matches the top anchor; not 4 because no checkpoint is missing for the skill's scope.

Progressive Disclosure

The three real reference files are well signaled ("references/overview.md — Both event types, the full envelope..." etc.) and one level deep, but scored against the actual bundle the structure breaks down: "see [examples/express/](examples/express/), [examples/nextjs/](examples/nextjs/), [examples/fastapi/](examples/fastapi/)" and "see `extractVcsInfo()` in the examples" point at directories/files that do not exist in the bundle — dead links to the promoted complete handlers. Additionally, the test-vector table, the gotchas list, and the ping JSON payload are duplicated nearly verbatim between SKILL.md and references/verification.md / overview.md, i.e. content that belongs in the separate files is inlined. Not 4 because dead links to a load-bearing resource are more than a minor organization gap; not 2 because the body is well sectioned and the references that do exist are clearly signaled and easy to navigate.

Specificity

"Receive and verify CircleCI outbound webhooks" plus the "Use when" verbs — "setting up a CircleCI webhook handler, debugging `circleci-signature` verification, or handling the `workflow-completed` and `job-completed` events" — name several concrete, distinct actions covering the domain's task space with concrete event names. It is not 5 because beyond receive/verify/debug/handle there are no further capability actions; the remainder of the description is signing-scheme detail ("HMAC-SHA256", "comma-separated versioned list (`v1=<hex>`)"), not additional capabilities. It is well above 3, which covers only 1-2 actions.

Completeness

The "what" is explicit and concrete ("Receive and verify CircleCI outbound webhooks", with the signing scheme specified), and the "when" is an explicit "Use when..." clause with three concrete trigger scenarios (setup, debugging verification, handling the two named events). This matches the anchor for clearly and explicitly answering both what and when with concrete trigger phrases; not 4, where the when would be less specific.

Trigger Term Quality

Natural user phrasings are comprehensively covered: "setting up a CircleCI webhook handler", "debugging `circleci-signature` verification", "workflow-completed and job-completed", plus the exact confusion term "Circle (circle.com, USDC/Circle Mint, ECDSA `X-Circle-Signature`)" that a user would type when they land on the wrong skill. The domain has no file extensions to cover, and no common synonym is missing.

Distinctiveness Conflict Risk

Clear niche (CircleCI outbound webhooks) with minimal conflict risk, and the description actively de-risks the two likeliest mis-triggers with explicit negation clauses: "Not Circle (circle.com...) — unrelated company" and "Not CircleCI custom webhooks, which are inbound pipeline triggers going the other direction". This exceeds the anchor for a clear niche with distinct triggers.