Conciseness

The body is dominated by lean, executable commands and tables, but the Overview paragraph ('build a database of the codebase (control flow, data flow, type info) ... pattern matchers cannot express') explains concepts the model already knows, fitting anchor 4's 'efficient; minor instances of over-explanation that could be trimmed' rather than anchor 5's every-token-earns-its-place.

Actionability

Fully executable, copy-paste-ready guidance throughout: curl/unzip install with version check, `codeql database create` for both interpreted and compiled-language cases, `database analyze` with explicit flags, an executable jq SARIF filter, and a filled-in inline-suppression template — covering the common cases as anchor 5 requires (SARIF upload detail is deliberately and clearly deferred to the reference file).

Workflow Clarity

Steps 1–5 are clearly sequenced (install → create → analyze → triage → performance) with an install verification and an anti-patterns table documenting failure modes, but there is no explicit checkpoint validating database creation or SARIF output between steps, matching anchor 4's 'clear sequence with most checkpoints present; minor validation gaps' rather than anchor 5's explicit validation steps and feedback loops.

Progressive Disclosure

The body is a well-organized spine that explicitly defers detail to a single one-level-deep reference — 'The full per-language pack list, the query suites ..., a custom `.ql` query example, and the GitHub Actions CI integration are in [references/codeql-reference.md](references/codeql-reference.md)' — and that file exists with exactly that content, matching anchor 5's 'well-signaled one-level-deep references; content appropriately split'.

Specificity

The description lists multiple concrete actions spanning the full workflow — 'setting up code scanning', 'finding injection that flows through helper functions across files', 'codeql database create and analyze per language, query packs, SARIF upload to code scanning, and suppressions' — which is comprehensive coverage for this domain, matching the anchor-5 example's breadth rather than anchor 4's 'minor gaps'.

Completeness

It explicitly answers 'when' with the concrete trigger phrase 'Use for any question or task about CodeQL or deep semantic static analysis (SAST) on a GitHub repo' and 'what' with the enumerated action list, matching anchor 5's 'clearly and explicitly answers both what AND when with concrete trigger phrases'.

Trigger Term Quality

Good natural keyword coverage including the synonym pair 'deep semantic static analysis (SAST)' plus 'CodeQL', 'code scanning', and 'injection', but a few natural terms users would say are missing (e.g., 'taint analysis', 'security scan', 'vulnerability scan'), fitting anchor 4's 'good coverage; a few natural terms missing' rather than anchor 5's comprehensive synonym list.

Distinctiveness Conflict Risk

CodeQL is a distinct named niche, but the broad trigger 'any question or task about ... deep semantic static analysis (SAST)' creates minor overlap risk with closely related SAST skills (e.g., semgrep/sonarqube), fitting anchor 4 ('mostly distinct; minor overlap risk') rather than anchor 5's minimal conflict risk.