Conciseness

The body is dense reference material (commands, filters, tables) rather than padded conceptual explanation, but there is notable duplication: the same queries appear in 'Common Search Queries', 'Useful Filter Combinations', and again in the Examples section (e.g., 'org:"Target Company"' and webcam/modbus queries repeat). This matches anchor 3 — mostly efficient but could be tightened — rather than 4, where duplication would be absent.

Actionability

Nearly everything is copy-paste executable: real CLI invocations with sample outputs ('shodan host 1.1.1.1', 'shodan download --limit 5000 results.json.gz "nginx"'), curl API calls, and a complete runnable Python automation script with error handling. This matches anchor 5 and exceeds anchor 4 because the examples cover the common cases end-to-end with concrete arguments rather than placeholders-only.

Workflow Clarity

An explicit 8-step core workflow sequences setup → host recon → search → filters → scanning → stats → monitoring → API, and the Troubleshooting table provides issue→cause→fix recovery loops. It falls short of anchor 5 because validation checkpoints are implicit rather than enforced — e.g., it never instructs verifying scan completion or credit balance before downloading results, and batch operations like 'download --limit -1' lack explicit verification steps.

Progressive Disclosure

Section structure with headers and quick-reference tables is good, but the skill is a ~495-line monolith with no references/ files at all: the ~150-line filter reference and the examples clearly belong in separate reference files per progressive-disclosure practice. This matches anchor 3 (content that should be separate is inline) rather than 2, because internal organization and navigation within the single file is solid.

Specificity

The what-clause 'provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance' names the domain and tooling but uses the buzzword 'comprehensive guidance' rather than listing concrete actions; the concrete actions only appear in the trigger phrases. This sits at anchor 3 (names domain and limited concrete actions) rather than 4, which requires several specific actions enumerated as capabilities.

Completeness

Both what and when are present, and the 'when' is explicit with concrete trigger phrases ('This skill should be used when the user asks to...'). It does not reach anchor 5 because the 'what' half leans on the vague 'comprehensive guidance' phrasing instead of concretely enumerating capabilities, matching anchor 4's 'when could be more explicit or specific' relaxation applied to the what-side.

Trigger Term Quality

Natural user phrases like 'search for exposed devices on the internet', 'find vulnerable services using Shodan', and 'discover IoT devices and open ports' are quoted verbatim as user asks, giving good keyword coverage. It falls short of anchor 5 because common variations such as 'run a Shodan query', 'look up a host on Shodan', or 'check Shodan for CVEs' are absent.

Distinctiveness Conflict Risk

Every trigger is Shodan-branded ('perform Shodan reconnaissance', 'scan IP ranges with Shodan') and the niche — internet-wide exposure search for pentest recon — is clearly distinct from general scanning or OSINT skills, giving minimal conflict risk. This clearly matches anchor 5 and not anchor 4, which would require some overlap with closely related skills.