Conciseness

The body is mostly lean, but the opening paragraph ("Without Secure, session tokens are transmitted in plain text over HTTP... any XSS payload can exfiltrate the session token in one line...") re-explains standard cookie-flag semantics Claude already knows, and the same attack-per-flag mapping is then repeated almost verbatim in the Quick Reference bullets (and again in references/rule.md). Removing the duplicated prose would lift it to 4–5.

Actionability

The guidance is concrete and specific for an instruction-only skill: "Update the server's cookie configuration to include Secure, HttpOnly, and SameSite=Strict (or Lax) on all session and auth cookies" and "Flag any cookies missing the HttpOnly flag, absent Secure flag, or an unspecified or overly permissive SameSite setting". Per the code-vs-instruction note the absence of code is not penalized, but there is a minor gap: no inline example of a correctly flagged Set-Cookie (it is deferred to the reference).

Workflow Clarity

The Check / Fix / Explain / Code Review sections give a clear, unambiguous structure for a simple skill, with the Check and Code Review sections acting as verification of current state before Fix. It is not 5 because there is no explicit validation step after applying the fix (e.g. re-inspecting the Set-Cookie headers to confirm all flags are present).

Progressive Disclosure

The body is a concise, well-sectioned overview and the single reference is clearly signaled one level deep: "For full implementation details, code examples, and framework-specific guidance, see `references/rule.md`" — the file exists and indeed holds the code example, flag table, and framework implementations. Content is appropriately split between overview and detail file with easy navigation.

Specificity

Names the domain and several concrete activity types — "reviewing server-side session management, setting up authentication middleware, or auditing cookie configuration in HTTP response headers" — which are specific rather than generic. It falls short of 5 because the actual capability (setting/verifying Secure, HttpOnly, and SameSite flags) is never stated, leaving a notable gap in coverage.

Completeness

Only the 'when' is present ("Use when reviewing...") with no 'what' — the description never states what the skill does. This matches the anchor 'only when is present without what' (e.g. "Use when working with documents"); despite the 'when' clauses being specific, scoring only what is explicitly stated, the 'what' cannot be credited, keeping it below 3.

Trigger Term Quality

Good natural keyword coverage: "session management", "authentication middleware", "cookie configuration", "HTTP response headers" — phrases a user would plausibly say. Key natural terms users would use for this exact skill are missing: "cookie flags", "Set-Cookie", "HttpOnly", "SameSite", "Secure flag", so it is not comprehensive enough for 5.

Distinctiveness Conflict Risk

The trigger scope is a fairly distinct security niche (session cookies, auth middleware, cookie headers) with minor overlap risk against broader authentication or general security-audit skills. It is not a 5 because "reviewing server-side session management" could also fire broader session/auth skills that don't focus on cookie flags.