Conciseness

The body is lean, assumes Claude's competence (no explanation of what Convex is, drops API names like ctx.auth.getUserIdentity() and withIndex without preamble), and every check is actionable. It is not a 5 because the Workflow passes and the Rules section repeat the same checks — .filter(), Date.now(), validators, and internal.*/api.* each appear twice — where a merged checklist with inline severity ("Flag X as Critical because Y") would be tighter and avoid cross-referencing two sections.

Actionability

Guidance is highly concrete for an instruction-only skill: specific APIs ("ctx.auth.getUserIdentity()", ".filter()", "withIndex", "Date.now()", ".collect()", "internal.* not api.*"), a hard threshold ("<8192 elements"), and explicit severity mappings. It stops short of a 5 because "verify resource ownership before reads/writes" gives no concrete pattern for how to verify ownership, and there is no example of the expected finding/report format despite instructing findings be grouped by severity.

Workflow Clarity

The three passes are clearly sequenced (security, then performance, then code quality) and conclude with an explicit reporting step ("Report findings grouped by severity; explain why each issue matters and suggest a fix"). This is a read-only review skill, so destructive/batch validation caps do not apply, and each pass functions as an explicit checklist for the process.

Progressive Disclosure

The skill is under 50 lines, self-contained, and has no bundle files (no references/, scripts/, or assets/ directories exist), so there is nothing that belongs in external files. Sections (Workflow, Rules) are well-organized, matching the rubric's simple-skill exception for scoring 5 with well-organized sections alone.

Specificity

The description lists several concrete capability areas — "security, auth, validators, performance, and pattern checks" — and scopes them to "code in a convex/ directory", which goes beyond naming the domain. It falls short of a 5 because it enumerates review categories rather than multiple individual concrete actions (compare the anchor-5 PDF example listing extract/fill/merge), and "pattern checks" is the vaguest of the listed items.

Completeness

It explicitly answers both questions: the "what" is "security, auth, validators, performance, and pattern checks for code in a convex/ directory", and the "when" is the explicit trigger clause "Use to review or audit Convex functions before shipping" with concrete trigger phrases. Not a 4 because the 'when' clause is already explicit and specific rather than merely present-but-imprecise.

Trigger Term Quality

Strong natural keyword coverage: "Convex", "code reviewer", "security", "auth", "validators", "performance", "review or audit", and "convex/ directory" — terms a user needing this skill would plausibly say, with the review/audit synonym pair. Not a 5 because it misses additional natural variations a user might say (e.g., "Convex backend", "Convex functions" appears only once, no file-extension mentions like .ts).

Distinctiveness Conflict Risk

"Convex code reviewer" carves out a clear niche with distinct triggers (Convex, convex/ directory, Convex functions), so it is unlikely to fire for unrelated skills. The only conceivable overlap is a generic code-review skill, but the Convex-specific framing keeps conflict risk minimal.