Conciseness

The body is lean and assumes competence: no explanation of what codesigning or Gatekeeper is, no filler; every section (Quick Start, Workflow, Useful Commands, Guardrails, Output Expectations) adds only domain-specific direction. Not a 4 because there is no over-explanation to trim — even the Quick Start adds triage framing ('smells like codesigning rather than compilation') rather than restating the description.

Actionability

Gives concrete, copy-paste-ready commands with argument placeholders: `codesign -dvvv --entitlements :- <path>`, `spctl -a -vv <path>`, `security find-identity -p codesigning -v`, `plutil -p`. Not a 5 because the repair half is instructive rather than executable — 'Show the shortest set of validation or repair commands' tells Claude to produce commands but provides no example repair/validation command (e.g., a re-sign or `codesign --verify` invocation) for the common cases.

Workflow Clarity

The four-step sequence (inspect bundle → read signing details → classify failure → explain fix path) is clear and ordered, with a useful failure taxonomy and explicit guardrails. Not a 5 because validation checkpoints are only implicit — step 4 says to 'show the shortest set of validation or repair commands' but the workflow has no verify-then-recheck loop of its own. Not a 3 because the operations are read-only diagnostics (not destructive/batch), so the validation cap does not apply and the sequence is otherwise complete.

Progressive Disclosure

The skill is under 50 lines, single-purpose, with no bundle files (references/, scripts/, assets/ are absent and the body references no external files), and it is organized into clean, well-labeled sections. Per the rubric's simple-skill guideline, this earns a 5 with well-organized sections and no external references needed.

Specificity

Lists several specific actions and targets — "Inspect signing, entitlements, hardened runtime, and Gatekeeper issues for macOS apps" and "diagnose code signing failures, missing entitlements, sandbox problems, notarization prerequisites, or trust-policy launch errors" — all concrete. Not a 5 because the actions collapse to a single 'inspect/diagnose' verb over a list of objects rather than multiple distinct operations (extract, fill, merge, convert), leaving minor coverage gaps such as repair or re-signing actions.

Completeness

Clearly answers both parts: what it does ("Inspect signing, entitlements, hardened runtime, and Gatekeeper issues for macOS apps") and when to use it ("Use when asked to diagnose code signing failures, missing entitlements, sandbox problems, notarization prerequisites, or trust-policy launch errors"). Matches the anchor-5 example structure exactly, so 4 ('when' could be more explicit) does not apply.

Trigger Term Quality

Good natural keyword coverage: "code signing failures", "missing entitlements", "sandbox problems", "notarization prerequisites", "Gatekeeper", "hardened runtime", "trust-policy launch errors" are phrases users would actually say when hitting these failures. Not a 5 because common user-facing variations are missing (e.g., "app won't open", "damaged and can't be opened", .app/.xcarchive extensions).

Distinctiveness Conflict Risk

Occupies a clear niche — macOS code signing / entitlements / notarization diagnostics — with domain-specific triggers (Gatekeeper, hardened runtime, spctl-style trust policy) that no adjacent skill would claim. Minimal overlap risk even with closely related macOS build or Xcode skills.