Conciseness

The ~30-line body is short, but it repeats itself: the audit-then-verify guidance appears in Quick Reference ("Audit every cross-origin script, iframe... before enforcing COEP"), Fix ("Add COOP and COEP only after auditing dependencies"), and Code Review ("Flag exact responses or integrations that would block isolation"), and the intro paragraph explains COOP/COEP purpose Claude already knows ("Cross-origin isolation reduces opener-based attacks and XS-Leak risk"). It could be tightened into a single ordered procedure.

Actionability

There is one fully concrete check ("Verify `self.crossOriginIsolated === true`"), but the body gives no executable header values — "Add COOP and COEP" without specifying `Cross-Origin-Opener-Policy: same-origin` / `Cross-Origin-Embedder-Policy: require-corp` — and defers all code to the reference file, leaving key details missing from the body itself.

Workflow Clarity

A sensible sequence is implied across sections (audit dependencies → enforce COOP/COEP → ensure CORP/CORS on subresources → verify crossOriginIsolated), and a verification checkpoint is stated twice. But it is never laid out as an explicit ordered procedure, and there is no recovery guidance for the common failure case where verification fails because one resource blocks isolation.

Progressive Disclosure

The body is a clean overview with well-organized sections and a single clearly signaled, one-level-deep pointer — "For full implementation details, code examples, and framework-specific guidance, see `references/rule.md`" — and that file exists in the bundle with the expected content.

Specificity

The description names its domain ("security-sensitive web apps... that require cross-origin isolation") and one concrete action ("Check both headers and real browser behavior"), but stops short of naming the COOP/COEP/CORP headers it actually works with, so coverage is not comprehensive.

Completeness

It explicitly answers "when" with a concrete "Use when reviewing security-sensitive web apps, SharedArrayBuffer usage..." clause, and gives a "what" ("Check both headers and real browser behavior"). The "what" is thinner than the "when" — it never states the skill configures or fixes COOP/COEP/CORP headers — so it falls just short of the top anchor.

Trigger Term Quality

Strong natural triggers like "SharedArrayBuffer usage", "worker-heavy apps", "editors", "measurement features", and "cross-origin isolation" cover the common ways users would raise this need. A few natural terms are missing — users would also say "COOP", "COEP", "CORP", or "crossOriginIsolated".

Distinctiveness Conflict Risk

The niche is clear (cross-origin isolation, SharedArrayBuffer, worker-heavy apps) with triggers unlikely to fire for unrelated skills. Minor overlap risk comes from the broad opener "reviewing security-sensitive web apps", which could collide with general security-review skills.