Conciseness

The body is dense and lean — commands, version gates, and edge-case routing with no explanations of concepts Claude already knows. It sits at 4 rather than 5 because the authorization-scoping caveat is repeated in several forms ("Plugin installation alone is not authorization", "a diagnostic approval does not grant blanket permission", "Runtime/login setup does not authorize enterprise installation"), which could be consolidated.

Actionability

Fully executable, copy-paste-ready commands are given for every step (`qodo --version`, the `${QODO_HOME:-$HOME/.qodo}/bin/qodo` fallback, the full `whoami` and `tools --refresh` invocations with real flags), with the `<qodo>` placeholder explicitly defined. It is above the 4 anchor because the commands cover the common cases completely, including an exact retry command for catalog failure.

Workflow Clarity

A clearly sequenced 4-step workflow (find/install runtime → connect → verify tools → hand off) with explicit validation checkpoints: a minimum version gate before authenticated commands, identity verification that gates step 3 ("Only after identity succeeds"), and per-step error-recovery feedback loops. This is a non-destructive setup skill, so the validation cap for destructive/batch operations does not apply.

Progressive Disclosure

References are conditionally loaded and well signaled (runtime.md for missing CLI/PowerShell, authentication.md for failed identity, host-recovery.md "only when encountered"), and the main body stays a concise overview. It falls short of the 5 anchor due to minor organization gaps: host-recovery.md nests a second-level link to skill-updates.md (which SKILL.md never references directly, hurting discoverability), and the unnumbered Configuration/Error Handling sections interrupt the numbered step sequence between steps 3 and 4.

Specificity

The description lists three concrete actions covering the full setup flow — "install the CLI, sign in, and verify tools" — which is comprehensive for a setup skill. It is not below this anchor (that would mean only 1-2 actions or minor coverage gaps), and there is nothing vague or generic in the phrasing.

Completeness

Both halves are explicit: what ("install the CLI, sign in, and verify tools") and when ("Use after plugin installation, on setup requests, or when a Qodo skill finds a missing CLI or login") with concrete trigger phrases. The 4 anchor would require the 'when' clause to be less explicit or specific, which is not the case here.

Trigger Term Quality

Natural trigger terms include "Qodo", "plugin installation", "setup requests", and "missing CLI or login" — phrases a user would plausibly say. It falls short of the 5 anchor because common variations like "Qodo CLI", "authenticate", or "log in" as standalone triggers are absent, but it is clearly above the 3 anchor ("Works with PDF files"-level keyword coverage).

Distinctiveness Conflict Risk

The Qodo brand name plus tightly scoped triggers ("after plugin installation", "when a Qodo skill finds a missing CLI or login") give it a clear niche with minimal overlap risk against generic setup or installation skills. It is not at the 4 anchor since there is no meaningful overlap with closely related skills implied by the text.