The body is lean — organized checklists and a fill-in output template with no padding or explanations of concepts Claude already knows; the only repetition (the 'do not report vulnerabilities' point) is mild scope reinforcement that earns its place.

Provides concrete, specific guidance: exact dependency manifests to look for (package.json, requirements.txt, go.mod, Gemfile, pom.xml), defined exploration categories, a fixed output path, and a complete markdown template to fill in — actionable for an instruction-only analysis skill where code is not expected.

Sequences Phase 1 (recon) → Phase 2 (architecture mapping) → writing sast/architecture.md, includes a 'drill into source code to confirm findings' checkpoint, and closes with an Important Reminders checklist; the task is read-only and non-destructive, so the destructive/batch validation cap does not apply.

No bundle files exist and none are needed; the skill is a self-contained overview with clearly headed sections and a single inline output template, with no deep reference material that would warrant splitting into separate files.

Lists multiple concrete actions — 'codebase analysis and architecture mapping', 'Explores the tech stack, frameworks, entry points, data flows, and trust boundaries', 'Outputs sast/architecture.md' — in third-person voice, matching the anchor for listing several specific concrete actions.

Explicitly answers both what (analysis/architecture mapping with a concrete output file) and when ('Use when asked to analyze a codebase for security or when sast/architecture.md does not yet exist', plus 'Run this before any vulnerability detection skill').

Includes natural user phrasings such as 'asked to analyze a codebase for security', 'security assessment', and 'architecture', which are terms a user would naturally say; not merely technical jargon.

Scoped to the 'first phase of a security assessment' and explicitly distinguished from vulnerability detection, giving it a clear niche unlikely to trigger the wrong skill.