Conciseness

Noticeably verbose with padded, duplicated sections: the ~35-line CAPABILITIES_SUMMARY comment block (e.g. "mobile_keystore_design: iOS Keychain (`kSecAttrAccessControl` with `.biometryCurrentSet`...)...") restates material that reappears in Trigger Guidance, Recipes, Subcommand Dispatch, Output Routing, and the Anti-Pattern Checklist, and time-stamped claims ("Selected 2025-03-11", "Officially deprecated 2025-12", "final pending as of June 2026") are scattered inline rather than confined to a deprecated section. It is above anchor 1 because the body is dense reference tables rather than explanations of concepts Claude already knows, but the repetition across sections goes beyond anchor 3's 'some unnecessary explanation'.

Actionability

Highly concrete guidance with exact parameters throughout — "m=19 MiB, t=2, p=1", "cost factor >=12", "random 96-bit IV", "max 10 GB or `2^32` messages per DEK, `<=10`-minute TTL", and specific APIs like `kSecAttrTokenIDSecureEnclave` and `setIsStrongBoxBacked(true)` — making it mostly executable for a design skill. It falls short of anchor 5 only because no worked design-spec example or code snippet is included despite Output Requirements demanding "code examples".

Workflow Clarity

The "THREAT -> SELECT -> DESIGN -> VERIFY -> DOCUMENT" table gives per-phase required actions, key rules, and read pointers, and VERIFY embeds a validation checkpoint ("Every design gets anti-pattern checklist") plus subcommand dispatch is unambiguous. Not anchor 5 because there is no feedback loop — no instruction to revise and re-verify a design when the anti-pattern checklist finds issues.

Progressive Disclosure

References are clearly signaled one level deep via the Recipes "Read First" column, Output Routing "Read next" column, and a dedicated Reference Map table (reference/patterns.md, reference/password-hashing.md, reference/post-quantum-migration.md, etc.). Not anchor 5 because none of those referenced files exist in the provided bundle, and substantial reference-scope content (the 17-row Anti-Pattern Checklist, PQC timeline detail, algorithm quick reference) is inlined in SKILL.md; not anchor 3 because navigation is easy and references are well signaled.

Specificity

"algorithm selection, key management, E2EE, KMS integration, signature verification, TLS" names six concrete capability areas, matching the 'several specific actions; minor gaps' anchor — body-advertised capabilities like password hashing and PQC migration are missing, so it falls short of the comprehensive anchor 5 but is well beyond the 1-2 actions of anchor 3.

Completeness

The capability list answers 'what' and "Use when designing crypto protocols or key rotation flows" explicitly answers 'when', but the when-clause covers only two triggers against six capability areas — explicit yet not as specific as anchor 5's concrete trigger-phrase coverage; it is clearly above anchor 3 because 'when' is stated, not implied.

Trigger Term Quality

Natural terms "crypto protocols", "key rotation flows", "E2EE", "KMS", and "TLS" give good keyword coverage, but common variations users would say — plain "encryption", "JWT", "password hashing", "post-quantum" — are absent, fitting anchor 4 rather than the comprehensive synonym coverage of anchor 5.

Distinctiveness Conflict Risk

Cryptographic architecture design is a clear niche, and triggers like "designing crypto protocols" and "key rotation flows" are design-oriented phrases unlikely to fire for scanning, privacy, or general security skills — minimal conflict risk, matching anchor 5.