Conciseness

The body is lean and assumes competence: every line is an invariant or instruction ('verify signatures, dedupe on event ID', 'Never put paid content in unpaid HTML or JSON', 'One price constant from the approved offer') with zero concept explanation and no padding. It matches the score-5 anchor (every token earns its place); even the parenthetical '(an over-broad refund fix was a benchmark cheat)' is two words of real signal about a known failure mode rather than fluff.

Actionability

Guidance is concrete and executable in intent — named test scenarios ('success, decline, 3DS, replay, reorder, invalid signature; use test clocks'), a defined reconciliation equation ('provider charges = internal orders = entitlements'), and a named repair path ('repair them through `fix-data-repair`'). It sits at the score-4 anchor rather than 5 because no actual commands are given (e.g., the specific provider-CLI invocations or signature-verification method), leaving minor gaps between instruction and execution.

Workflow Clarity

A clear 7-step procedure with explicit validation: the enumerated TEST-mode scenario matrix, the 'Live money actions need approval' gate for risky operations, a defined repair step, and an 'Exit criteria' checklist ('zero orphans', 'isolation holds'). This satisfies the score-4 anchor (clear sequence, most checkpoints present) but not score-5: there is no explicit error-recovery loop after a failing test scenario, and the steps read more as invariants than an ordered loop.

Progressive Disclosure

The skill is under 50 lines with no bundle files (references/, scripts/, assets/ are absent), and the body is well organized into 'Procedure' and 'Exit criteria' sections. Per the rubric's simple-skill guideline, this scores 5; its only cross-references ('fix-data-repair', 'qa-payments-billing') are clearly signaled and one level deep.

Specificity

The description lists multiple concrete action areas — 'Fix checkout, payment webhook, entitlement, subscription, refund, and price-display bugs' — each paired with a concrete expected outcome ('only verified provider events grant access, events are idempotent, refunds revoke, and money totals reconcile'). This matches the score-5 anchor (multiple specific concrete actions, comprehensive coverage) and exceeds the score-4 anchor, which allows 'minor gaps in coverage'; every bug class named also has a stated success condition.

Completeness

Both halves are explicit: 'what' is the enumerated fix scope with verifiable end-states, and 'when' is the explicit trigger clause 'Use for any money-moving or paywalled defect.' This matches the score-5 anchor (clearly and explicitly answers both what AND when with concrete trigger phrases); the score-4 anchor would require the 'when' to be only loosely specified, which is not the case here.

Trigger Term Quality

Natural trigger terms are strong: 'checkout', 'payment webhook', 'subscription', 'refund', 'price', 'money-moving', 'paywalled' — phrases a user reporting a billing bug would plausibly say. It falls short of the score-5 anchor (comprehensive coverage including synonyms/extensions) because common variations like 'billing' (only in the skill name), 'invoice', 'charge', or named providers (Stripe, chargeback) are absent.

Distinctiveness Conflict Risk

The trigger 'any money-moving or paywalled defect' carves out a clear niche with minimal overlap risk — generic web-fix or database skills would not match money-movement triggers. The verified-webhook/entitlement framing further distinguishes it from general checkout/UI skills, matching the score-5 anchor; it does not merely sit at 'mostly distinct' (score 4).