Conciseness

The Overview paragraph explains what BloodHound CE is ('a modern, web-based Active Directory reconnaissance platform developed by SpecterOps that uses graph theory') and the 'Key Attack Path Types' table re-explains Kerberoasting and AS-REP roasting — concepts Claude already knows — and the MITRE table is duplicated in both the frontmatter and references/standards.md. The 'When to Use' section also contains filler ('security assessments that involve conducting internal reconnaissance with bloodhound ce'). This is more than the 'minor instances' of anchor 4, fitting anchor 3's 'some unnecessary explanation'.

Actionability

The body is copy-paste ready throughout: Docker Compose deployment commands, SharpHound invocations with concrete flags ('-c All', '-c DCOnly', '--loop --loopduration 02:00:00'), a complete bloodhound-python command line, and six executable Cypher queries covering the common analysis cases. The few soft steps ('Transfer SharpHound v2 to the compromised Windows host', 'Exfiltrate the generated ZIP file') are inherently engagement-specific, keeping it at anchor 5.

Workflow Clarity

Five clearly sequenced phases with numbered steps plus a closing Validation Criteria checklist give a solid sequence with most checkpoints present. It falls short of anchor 5 because validation is not inline — there is no 'verify the import succeeded before running queries' step or error-recovery feedback loop for failed uploads or partial collections.

Progressive Disclosure

The bundle contains relevant files (references/api-reference.md, standards.md, workflows.md, scripts/agent.py, process.py, assets/template.md), but the body never mentions or links to any of them. Meanwhile content that belongs in those files — the MITRE mapping (duplicated in standards.md), the workflow detail (duplicated in workflows.md), and the report template — is inlined, matching anchor 3: 'references present but not clearly signaled; content that should be separate is inline'.

Specificity

The description lists multiple concrete actions — 'Conduct internal Active Directory reconnaissance', 'mapping ACLs, sessions, and group memberships into attack paths', 'identify privilege escalation chains', 'validate that AD hardening closed known attack paths' — with named collectors (SharpHound, AzureHound), giving comprehensive coverage. It exceeds anchor 4 because the collect-map-identify-validate chain leaves no significant capability gaps.

Completeness

Both parts are explicit: the 'what' is the full reconnaissance-to-attack-path workflow, and 'Use after an initial AD foothold to identify privilege escalation chains, or to validate that AD hardening closed known attack paths' is an explicit when-clause with concrete triggers, matching the anchor-5 example structure.

Trigger Term Quality

Strong natural keywords ('BloodHound', 'Active Directory', 'AD', 'attack paths', 'privilege escalation', 'Domain Admin', 'reconnaissance') that users would plausibly say. It falls short of anchor 5 because common variations such as 'AD recon', 'post-exploitation', or 'escalation paths' are absent.

Distinctiveness Conflict Risk

The description is anchored to a clear niche (BloodHound CE, AD attack paths, Domain Admin) with tool-specific triggers, so it is unlikely to fire for unrelated skills; overlap risk with generic AD-recon skills is minimal.