Lean and expert-facing; assumes Claude's knowledge of HTTP/caching and spends tokens only on the non-obvious defect model, severity bands, and the lru_cache mechanism, all of which earn their place.

Provides copy-paste-ready executable code (the namespaced cache_key builder, the Vary header block, before/after dashboard example) plus a concrete output-shape template and regression test guidance.

The 'Deriving the required discriminator set' section gives a clear 6-step sequence with explicit tier-check and severity-classification checkpoints, and pairs every critical finding with a regression test (a validation/verification feedback loop).

SKILL.md is an overview that cleanly offloads the deep lru_cache mechanism and verbatim RFC/OWASP citations to two real, well-signaled one-level-deep reference files (references/lru-cache-trap.md, references/http-cache-directives.md), both confirmed present.

Names many concrete actions (ranks identity discriminators above presentation ones, maps missing discriminators to consequences, classifies into severity bands, writes a namespaced key builder plus matching HTTP Vary header).

Explicitly answers both what (audits and ranks discriminators, classifies severity, writes fixes) and when via 'Use when a cache key is being designed or changed, when a per-user or per-tenant response is about to be stored... or when investigating a report that one user or tenant saw another's data'.

Uses natural terms a user or engineer would say: 'cache key', 'per-user', 'per-tenant', 'shared cache', 'CDN', 'saw another's data'.

A clear, narrow niche (cache-key discriminator auditing) with distinct triggers unlikely to fire for unrelated skills.