Conciseness

The body is dense and directive with no padding about concepts Claude already knows (no 'what is a security audit' filler), but several sentences pack many conditions into very long clauses that could be tightened; it fits the 'efficient; minor instances that could be trimmed' anchor rather than the 'lean, every token earns its place' anchor, so not a 5.

Actionability

Provides concrete, specific commands (generate_rank_input.py make-repo-scope-input/bind-repo-scopes, finalize_scan_contract.py with full flags) and exact tool-call signatures (record_codex_security_scan_draft({...}), complete_codex_security_scan({...})); falls short of 5 because heavy SDK-vs-host-vs-prompt-only branching means no single copy-paste path covers the common case.

Workflow Clarity

A clear 4-step numbered sequence with explicit validation checkpoints (preflight must return 'ready', 'Verify all three canonical JSON files exist', draft-rejection retry 'at most twice', 'return only after completion succeeds and report.md exists') and feedback loops for error recovery, matching the top anchor; the destructive/batch cap does not apply because validation is present.

Progressive Disclosure

References are clearly signaled and one level deep ('load references/desktop-scan.md', 'Read ../../references/scan-prologue.md once', 'Read ../../references/core-scan.md once'), and desktop-scan.md exists in the bundle; minor gap because references/scan-artifacts-and-ledger.md is present but unreferenced in the body, so structure is good but not perfectly organized.

Specificity

Names the domain ('single-pass security audit') and concrete scope targets (repository, path, package, folder, submodule), but offers only one core action rather than a comprehensive list of distinct operations, matching the 'names domain and 1-2 concrete actions' anchor; not a 4 because it does not enumerate several specific actions.

Completeness

Explicitly answers both what ('standard, single-pass security audit of an entire repository or scoped path...') and when ('Use for...' plus a concrete 'Do not use for PR, commit, branch, or working-tree diffs...') with concrete trigger phrases, matching the top anchor.

Trigger Term Quality

Includes natural terms users would say ('security audit', 'repository scan', 'scan') plus file/scope variants; falls short of 5 because common synonyms like 'vulnerability', 'security review', or 'find vulnerabilities' are absent.

Distinctiveness Conflict Risk

The explicit 'Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans' carve-out gives it a clear niche (standard single-pass repo audit) with minimal conflict risk against adjacent scan skills.