The body is a tight reference catalog: dense tables (What introspection exposes, Per-framework controls, Testable behaviours, Anti-patterns) and minimal code snippets with no padded explanations of basic GraphQL concepts. Every section earns its place; it is not the score-2 case with unnecessary explanation that could be tightened.

Provides concrete, copy-paste-ready guidance: exact config ("introspection: false", "introspection: process.env.NODE_ENV !== 'production'", "hideSchemaDetailsFromClientErrors: true"), per-framework settings table, and a Testable-behaviours table with specific queries and expected responses (e.g. "POST /graphql { __schema { types { name } } } -> 400"). This matches the score-3 'fully executable / specific examples' anchor.

This is a reference catalog (explicitly 'does not execute anything'), and the Testable-behaviours section acts as a clear checklist with an explicit validation caveat ('These tests must run against the production configuration - running them against NODE_ENV=test may give false positives'). Per the simple/reference-skill allowance, a well-structured single-purpose reference scores 3 without a multi-step workflow; it is not the score-2 case of a sequence with missing checkpoints.

Well-organized into clearly-signaled sections (Overview, When to use, What introspection exposes, Production controls, Mitigations, Testable behaviours, Anti-patterns, Limitations, References). Peer-skill references (persisted-query-strategy-reference, apollo-server-tests, etc.) are one level deep and clearly labeled; no nested/deep reference chains. Matches the score-3 'well-organized sections' allowance for reference skills with no bundle files.

Lists many concrete capabilities in one sentence: "what introspection exposes (every type, field, directive, deprecation, description via __schema / __type)", "Apollo Server's default behaviour (introspection: false when NODE_ENV=production)", "the hideSchemaDetailsFromClientErrors: true companion setting", "Yoga / Mercurius / Hasura equivalents", "query-depth + query-cost limits", "persisted-query allowlisting as the strongest mitigation", and "the testable behaviours each control creates". This matches the anchor 'Lists multiple specific concrete actions'; it is not the level below which only names a domain and some actions.

Clearly answers both what ("Pure-reference catalog of GraphQL introspection as an attack surface and the production-deployment controls for it") and when ("Use when designing the production-safety posture of a GraphQL server or auditing an existing deployment"). The explicit 'Use when' clause matches the score-3 anchor; it is not the score-2 case where 'when' is missing or only implied.

Includes natural terms a practitioner would say for this niche: "GraphQL", "introspection", "production-safety posture", "auditing an existing deployment", "production-deployment controls". Coverage is good and natural for the target audience; it is not the score-2 case of only some relevant keywords with missing common variations.

Occupies a clear, narrow niche (GraphQL introspection as a production attack surface) with distinct triggers unlikely to fire for unrelated skills; it is not the score-2 case of overlapping with similar broad skills.