Conciseness

Dense, table-driven body with zero concept explanations Claude already knows ('Do not pepper the user with questions', 'Never ask about: output format (default to cli)...'). The one trim opportunity is that the mode dispatch table and the wizard Q1 prompt enumerate the same 8 modes twice with near-identical descriptions — minor duplication, not padding.

Actionability

Concrete Checkov flags ('--download-external-modules true', '--framework secrets --enable-secret-scan-all-files', '--scan-secrets-history', '--deep-analysis') plus verbatim prompt text ('Enter 1–8 or mode name:') make the guidance mostly executable. Not 5 because complete, copy-paste-ready checkov command lines are deferred to references/checkov.md rather than shown, leaving a gap in the body itself.

Workflow Clarity

Sequencing is explicit — parse the first word of $ARGUMENTS, empty input routes to the wizard (Q1 then Q2), classify intent before asking anything — and the risky operations carry confirmation checkpoints ('Apply these changes? (y/N) — show unified diff first'; 'Write .checkov.yaml to <path>? (y/N)'), so the destructive-operation cap does not apply. Not 5 because error-recovery loops for bootstrap or scan failures are not surfaced in the body.

Progressive Disclosure

The body correctly defers all mode logic to a single, clearly signaled, one-level-deep reference ('Read `references/checkov.md` before responding'), but that file does not exist in the bundle — no references/, scripts/, or assets/ directories are present — so the disclosure chain dead-ends and the skill's core content is unreachable. The design would score 5; the actual bundle structure, which the guidelines direct scoring against, breaks it.

Specificity

Lists multiple concrete, comprehensive actions — 'Bootstrap Checkov', 'run static or plan-level Terraform security scanning for AWS/Azure/GCP/EKS', 'generate pre-commit hooks', 'produce multi-format output (cli/json/sarif/junit)' — which matches the top anchor. Reduced by 1 per the judging guideline because 'with a GITHUB_PAT you export' slips into second-person voice, violating the third-person requirement.

Completeness

Explicitly answers both 'what' (bootstrap, scan, resolve private modules, generate pre-commit hooks, produce multi-format output, fix violations) and 'when' ('Use when asked to "scan my Terraform", "run checkov"...') with concrete trigger phrases, matching the anchor for 5 exactly. Not 4 because the 'when' clause is fully explicit with quoted trigger phrases rather than generic.

Trigger Term Quality

Triggers are natural user phrasing — 'scan my Terraform', 'run checkov', 'check my IaC for security issues', 'set up checkov pre-commit', 'fix checkov findings' — exactly what a user would say. A few common variations (e.g., '.tf files', 'security scan', 'secrets in code', 'compliance scan') are missing, so coverage is good rather than comprehensive.

Distinctiveness Conflict Risk

Clear niche — Checkov-based Terraform/IaC security scanning with pre-commit setup — and named-tool triggers ('run checkov', 'fix checkov findings') make wrong-skill triggering unlikely. Only a faint overlap risk exists with generic security-review skills via 'check my IaC for security issues', but that does not rise to the 'minor overlap' of the 4 anchor.