Lean sections (overview, when/how to use, cross-ref script, CI YAML, worked example, anti-patterns, limitations) that assume Claude's competence and avoid explaining basic SCA/static-analysis concepts; every section earns its place. Not the level-2 'mostly efficient but could be tightened' case — there is no padded explanation.

Copy-paste-ready executable guidance throughout: 'npx knip --reporter json | jq -r ".dependencies[].name" > unused-deps.txt', a complete Python cross-reference script, and a concrete CI YAML block — matches the 'fully executable code/commands' anchor.

A 7-step 'How to use' sequence with an explicit validation checkpoint and feedback loop: step 5 'assert unused-deps.txt is non-empty and every finding ... carries a populated reachable field ... If the file is empty ... re-run ... and re-annotate', satisfying the validation requirement for batch finding annotation.

SKILL.md is an overview with a single one-level-deep, clearly signaled reference — 'Full config, flags, exit codes, and suppression per tool: references/dead-dependency-tools.md' — and the referenced bundle file exists and is real. Per-tool detail is correctly split out, with a References section listing external links.

Lists multiple concrete actions with named tools: 'Runs dead-dependency analysis across JS, Python, and Rust projects using ecosystem-native static tools (depcheck/knip for JS, vulture for Python, cargo-machete for Rust), then cross-references the unused-dependency list against SCA findings to downrank vulns' — matches the 'Lists multiple specific concrete actions' anchor.

Explicitly answers both what (dead-dependency analysis + SCA cross-reference to downrank vulns) and when (explicit 'Use when SCA output ... is too noisy to triage' clause), matching the top anchor with an explicit trigger.

Natural trigger phrasing for the target audience: 'Use when SCA output ... is too noisy to triage and the team needs to separate unreachable CVEs from exploitable ones before sprint planning' — terms a security engineer would actually say, not generic jargon.

Clear niche (reachability via dead-dependency detection) and actively disambiguated from a sibling: 'sibling cve-exploitability-triage ranks by EPSS/KEV exploitation signal, not code reachability' — unlikely to trigger for the wrong skill.