Conciseness

The body is a lean directive-per-line ruleset that assumes Claude's competence — it names CSRF, CSP nonces, SameSite cookies, and row-level security without explaining any of them. Every token earns its place, including the one-sentence scoping note that delegates stack-specific rules to the skill matrix.

Actionability

Concrete throughout: named mechanisms ("HTTP-only, `Secure`, `SameSite` cookies", "DOMPurify", "`Strict-Transport-Security`, `X-Content-Type-Options: nosniff`, `Referrer-Policy`") and copy-paste commands ("`openssl rand -hex 32`", "`curl -I` against a preview URL", "`npm audit`"). It stops short of anchor 5's fully-executable standard because several rules are behavioral directives ("Check on the server, for every read and write, who is asking") with no executable example.

Workflow Clarity

A single-purpose ruleset under 50 lines with unambiguous, well-organized rules, so the simple-skill exception applies. It also embeds explicit validation checkpoints — "Check what actually ships with `curl -I`", "keep a test that proves another user reads nothing", "Check a new dependency's audit... before adding it" — and involves no destructive or batch workflow that would cap the score.

Progressive Disclosure

A self-contained skill under 50 lines with no need for external reference files; the five thematic sections are well-organized and the single pointer to stack-specific rules (`.opencastle/agents/skill-matrix.json`) is clearly signaled and one level deep.

Specificity

Enumerates several concrete coverage areas — "authentication, authorization, data access policies, input handling, headers and CSP, secrets and scheduled routes" — going well beyond naming the domain. It falls short of anchor 5 because these are topics ("rules for X") rather than the concrete action verbs the top anchor expects.

Completeness

Clearly answers "what" (security rules across seven enumerated areas) and "when" via an explicit "Use when..." clause with six concrete trigger phrases, exactly matching the anchor-5 pattern. Not 4, because the "when" is fully explicit rather than merely present.

Trigger Term Quality

The trigger clause includes natural phrases users would say — "building an auth flow, adding an endpoint or handler, writing access policies, setting security headers, handling user input, or auditing security". It misses common synonyms such as "login", "sessions", or "permissions", keeping it below anchor 5's comprehensive synonym coverage.

Distinctiveness Conflict Risk

The build-time hardening niche (auth, access policies, headers, secrets, cron routes) is clearly staked out, but "auditing security" and the broad security domain create minor overlap risk with a dedicated security-review or secrets-management skill.