The body is lean and assumes Claude's competence — it does not explain what webhooks or HMAC are, and defers detail to reference files rather than padding the overview. Every section earns its place.

Instruction-only but highly actionable: names the exact algorithm ('HMAC-SHA256', 'HMAC(raw_body, signing_secret)'), provider headers, idempotency storage in Redis, and a dispatch map. The instruction-only carve-out applies since guidance is concrete and specific despite no inline code.

Eight numbered steps give a clear sequence, step 8 provides a validation checkpoint (replay tests with valid and tampered signatures), and the Error Handling table supplies cause/solution feedback loops for recovery.

Body is an overview that clearly signals one-level-deep references (implementation.md, errors.md, examples.md) — all of which exist in ./references/ — with content appropriately split and easy navigation.

Lists multiple concrete actions — 'signature verification, retry logic, and payload validation' plus 'webhook endpoints' — rather than vague language, matching the 'lists multiple specific concrete actions' anchor.

Explicitly answers both 'what' (create webhook endpoints with signature verification, retry logic, payload validation) and 'when' (an explicit 'Use when receiving and processing webhook events' clause plus trigger phrases).

Provides natural phrases users would say — 'create webhook', 'handle webhook events', 'setup webhook handler' — giving good coverage of likely trigger terms.

Targets a clear niche (webhook receivers) with provider-specific signature schemes, making it unlikely to trigger for unrelated skills.