Conciseness

The templates, commands, and best-practice lists are dense and earn their place, but the body spends tokens on things Claude already knows: an ASCII diagram walking through "1. ClientHello / 2. ServerHello + Cert ... 5. Encrypted Channel", a certificate-hierarchy diagram, and boilerplate filler like "Clarify goals, constraints, and required inputs. Apply relevant best practices and validate outcomes" and a "Do not use this skill when" section stating "The task is unrelated to mtls configuration". This matches anchor 3 ("Mostly efficient but includes some unnecessary explanation or could be tightened"); it does not reach 4 because the padding spans several distinct sections, and is not 2 because the majority of the file is genuinely lean configuration content.

Actionability

Five complete, copy-paste-ready Kubernetes manifests (Istio PeerAuthentication/DestinationRule, cert-manager issuer and Certificate, SPIRE server config, Linkerd policy) plus concrete executable commands like "istioctl proxy-config secret deploy/my-app -o json | jq ... | base64 -d | openssl x509 -text -noout", "kubectl rollout restart deployment/my-app", and "linkerd viz edges deployment -n my-namespace". The common cases (enable strict mTLS, migrate permissively, issue workload certs, check expiry, debug handshakes) are each covered by runnable examples, matching anchor 5; remaining placeholders like <base64-encoded-ca-cert> are user data, not gaps, and the one abbreviated DaemonSet is explicitly labeled as such.

Workflow Clarity

No sequenced implementation workflow exists — the file is a reference collection, with the migration path only implied by "Start with PERMISSIVE - Migrate gradually to STRICT" and verification commands (cert expiry check, tls-check, linkerd viz edges) scattered in separate sections rather than embedded as checkpoints. This matches anchor 3 ("sequence present but checkpoints missing or implicit"); validation content does exist so it is above anchor 2, but there is no ordered step sequence with validation gates to reach anchor 4.

Progressive Disclosure

The file has clear section headers (Core Concepts, Templates, Certificate Rotation, Debugging, Best Practices, Resources) but is a ~360-line monolith with no bundle files; roughly 200 lines of per-platform templates (Istio, cert-manager, SPIRE, Linkerd) are inlined in SKILL.md where they clearly belong in one-level-deep reference files. This matches anchor 3 ("content that should be separate is inline"); structure is real so it is above anchor 2's no-organization example, but nothing is split out to reach anchor 4.

Specificity

"Configure mutual TLS (mTLS) for zero-trust service-to-service communication" names the domain and one concrete action, but does not enumerate the range of capabilities the skill actually covers (Istio/Linkerd setup, cert-manager issuance, SPIFFE/SPIRE, rotation, debugging). This matches anchor 3 ("Names domain and 1-2 concrete actions, but not comprehensive"); it is above anchor 2 because the action is concrete rather than generic, and below anchor 4 because only one capability is listed.

Completeness

The description explicitly answers both questions: what ("Configure mutual TLS (mTLS) for zero-trust service-to-service communication") and when ("Use when implementing zero-trust networking, certificate management, or securing internal service communication") with three concrete trigger phrases. This matches anchor 5; anchor 4 would require the 'when' clause to be less explicit or specific, which it is not.

Trigger Term Quality

Natural phrases like "mutual TLS (mTLS)", "zero-trust networking", "certificate management", and "securing internal service communication" are terms a user would plausibly say. It falls short of anchor 5 because common variations users actually say — "service mesh", "Istio", "Linkerd", "cert rotation", "TLS handshake" — are absent, matching anchor 4 ("Good keyword coverage; a few natural terms missing").

Distinctiveness Conflict Risk

mTLS/zero-trust service-to-service communication is a clear niche with distinct triggers, but the trigger "certificate management" is broad and could overlap with general TLS/certificate-automation skills. This matches anchor 4 ("Mostly distinct; minor overlap risk with closely related skills") rather than anchor 5, which demands minimal conflict risk across all triggers.