Conciseness

Sections are dense and operational (when/when-not, rationalizations to reject, anti-patterns with code, strictness rules) with no explanation of concepts Claude already knows, e.g. no preamble about what Semgrep is. Scored 4 not 5 because passages like "Why prioritize taint mode?" re-argue a point already stated as a rule and could be trimmed.

Actionability

Quick Start provides copy-paste-ready YAML, a matching test file, and the exact command `semgrep --test --config <rule-id>.yaml <rule-id>.<ext>`, plus a concrete output structure, a tracked checklist, and seven specific documentation URLs. This covers the common case fully executably, matching the 5 anchor rather than 4.

Workflow Clarity

A 7-step tracked checklist with explicit validation requirements ("100% test pass is required", iterate until all tests pass, Final Run) satisfies the validation expectation, so no cap applies. Scored 4 rather than 5 because the per-step semantics live in workflow.md, leaving the in-body sequence as labeled steps rather than a fully specified sequence with inline feedback loops.

Progressive Disclosure

The body keeps a quick start inline while pushing commands/operators to references/quick-reference.md and the detailed workflow to references/workflow.md, both clearly signaled via {baseDir} links that resolve to real files one level deep (workflow.md links only back to SKILL.md and its sibling reference). This matches the 5 anchor: clear overview with well-signaled one-level-deep references and easy navigation.

Specificity

"Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns" names the domain and one concrete action with three detection targets, but offers no other actions (testing, taint mode, validation). Matches the 3 anchor (domain plus 1-2 concrete actions, not comprehensive) better than 4, which expects several distinct actions listed.

Completeness

A clear what ("Creates custom Semgrep rules for detecting...") is paired with an explicit when ("Use when writing Semgrep rules or building custom static analysis detections"). Not 5 because the when-clause is narrower than the anchor's fuller concrete trigger set, omitting scenarios like taint-mode rules or rule testing.

Trigger Term Quality

"Semgrep rules", "security vulnerabilities", "bug patterns", and "static analysis detections" are phrases users naturally say, giving good keyword coverage. Not 5 because common synonyms such as "taint analysis", "SAST", or "linting" are absent.

Distinctiveness Conflict Risk

"Semgrep" names a distinct tool niche with distinct triggers, so conflict risk is minimal. The only mild overlap is with a generic static-analysis skill via "custom static analysis detections", but the tool name dominates, matching the 5 anchor rather than 4.