Conciseness

The body opens by explaining what Burp Suite is ("Burp Suite is a popular set of tools used for web application security testing... It acts as a proxy, allowing users to intercept and manipulate HTTP traffic") — knowledge Claude already has — and includes a ~20-item bullet list of bare tool names with no guidance value. The `action list` command is also duplicated in both "Searching for actions" and "Popular actions". Anchor 3 fits; not 2 because the padding is localized and the CLI guidance itself is efficient.

Actionability

Concrete, copy-pasteable commands throughout: `npm install -g @membranehq/cli@latest`, `membrane connection ensure "https://portswigger.net/burp" --json`, `membrane action run <actionId> --input '{"key": "value"}' --json`, plus a full flags table for `membrane request`. Not 5 because no Burp-specific action examples (e.g., listing scan issues or reading proxy history) are shown, so the app's common cases aren't covered; not 3 because the guidance is executable, not pseudocode.

Workflow Clarity

A clear sequence (install → login → connection ensure → poll state → handle clientAction → discover/run actions → proxy fallback) with explicit state checkpoints (READY / CLIENT_ACTION_REQUIRED / CONFIGURATION_ERROR) and a poll-again loop after user actions. Not 5 because "skip to **Step 2**" is referenced twice but no Step 2 exists in the document (the only numbered heading is "1b"), and there is no validation guidance after running an action; not 3 because checkpoints are explicit rather than missing.

Progressive Disclosure

No bundle files exist and the single-file body is ~140 lines with clear sections, but the clientAction state-machine detail, the proxy flags table, and the tool-name overview list are inline material that belongs in a reference file, and there is no navigation to deeper material at all. Anchor 3 (some structure, could be better organized); not 4 given the inlined detail and absence of any reference pointers.

Specificity

"Burp Suite integration" names the domain, but the stated actions — "Manage data, records, and automate workflows" — are generic data-management verbs with no Burp-specific concrete action (scanning, reading proxy history, retrieving issues). This matches anchor 2 (domain named, actions minimal or generic), not 3, since no concrete capabilities are enumerated.

Completeness

Both an explicit "what" ("Manage data, records, and automate workflows") and an explicit "when" ("Use when the user wants to interact with Burp Suite data") are present. Not 5 because the "when" clause is circular — it restates the domain instead of giving concrete trigger phrases — and the "what" is vague; not 3 because the "Use when" trigger guidance is explicit, not weakly implied.

Trigger Term Quality

"Burp Suite" is the natural product-name keyword users would say, but common variations and synonyms (portswigger, web application security testing, intercepting requests, pentest proxy) are absent. Good fit for anchor 3; not 2 because the keyword is specific rather than generic, not 4 because coverage is limited to the product name alone.

Distinctiveness Conflict Risk

"Burp Suite" is a clear niche product name that no other plausible skill would trigger for, and the "Use when" clause ties usage to Burp Suite specifically. Only a minor generic tail ("Manage data, records"), so anchor 5 (clear niche, minimal conflict risk) is the best fit.