Conciseness

The body is dense, imperative, and free of concept explanation or padding — even implementation details like 'npm exec qm does not work in a source checkout; the workspace symlink points at cli/' are non-obvious operational facts Claude could not infer. Every token earns its place, matching the lean anchor.

Actionability

Commands are copy-paste executable with clearly marked parameters: 'npm install --save-exact @yc-software/qm@<version>', 'node cli/bin/qm.ts check --config deploy/layers/<org>/qm.config.jsonc', full 'gh pr create --repo <source-fork> --base main ...' blocks, and the complete merge sequence. Not a 4 because no step relies on pseudocode or unstated detail.

Workflow Clarity

Clear sequence (identify checkout → merge → resolve conflicts → verify → open PR) with explicit validation checkpoints ('check', 'doctor', 'plan', typecheck, lint, per-layer contract-major check) and error-recovery branches ('Already up to date' → report instead of an empty PR; unsupported contract major → adapt as part of the sync). Destructive risks (push, merge, landing) all have pre-flight validation.

Progressive Disclosure

Sections are well-organized and appropriately scoped for a single-file skill with no bundle files provided, matching the good-structure anchor. It is not a 5 because the two distinct procedures (package deployment vs. source fork) are interleaved in one body, and pointers such as the README, AGENTS.md, and the 'upstream-pr' skill are external mentions rather than clearly signaled bundle references.

Specificity

The description lists multiple concrete actions spanning both skill modes — 'Update a QM source fork by merging upstream, or upgrade a package deployment dependency, and open a PR' — giving comprehensive coverage of what the skill does. It is not a 4 because no capability of the skill is left out of the action list.

Completeness

It explicitly answers both what (merge upstream into a source fork, or upgrade a package deployment dependency, then open a PR) and when ('Use when asked to...') with concrete trigger phrases. Not a 4 because the 'when' clause is explicit and enumerated rather than merely adequate.

Trigger Term Quality

Natural trigger phrases are present ('update qm', 'sync from upstream', 'pull in the latest qm'), matching the good-coverage anchor. It is not a 5 because common variations such as 'upgrade qm', 'bump the qm dependency', or 'qm version' are missing.

Distinctiveness Conflict Risk

The 'qm' qualifier makes the skill clearly distinct, but the trigger 'sync from upstream' is generic enough to overlap with general git-upstream-sync skills. It is not 5 due to this minor overlap risk, and not 3 because the domain qualifier and package-path wording keep it well out of broad-skill territory.