Lean and code-forward — seven steps are each backed by short code/tables rather than prose, and it assumes Claude's competence (no 'what a test case is' padding). Not below 3 because the overview, worked example, anti-patterns, and limitations each earn their tokens by being concrete rather than explanatory filler.

Provides executable artifacts — a real `grep -r` scan, the `build_coverage_matrix` / `find_orphan_tests` functions, monitor YAML, and a CI workflow block. Not below 3 despite undefined adapter helpers (`load_matrix`, `testrail_search`) because the core matrix and orphan logic is complete and the helpers are clearly external integration seams rather than pseudocode standing in for real logic.

Seven explicitly numbered steps (Ingest → Inventory → Build matrix → Emit → Orphan tests → Executive summary → CI) with a coverage-depth verdict table and a worked example tracing the same steps. Not below 2 because this is an analysis/reporting workflow (not destructive or batch-mutating), so the missing-feedback-loop cap does not apply, and the CI gate supplies a fail-on-uncovered-critical checkpoint.

SKILL.md is an overview that offloads the full output skeletons to references/risk-coverage-output-templates.md (verified to exist), referenced twice via clear markdown links and exactly one level deep. Not below 3 because the split is appropriate — the steps stay inline while bulky templates move to the reference file.

Lists multiple concrete actions — 'ingesting risks', 'inventorying test coverage', 'computing per-risk coverage depth', 'identifying orphan risks + orphan tests', and 'Output is a Markdown matrix + executive summary'. Not below 3 because the actions are specific and comprehensive, not just a domain label; the 'Build-an-X workflow' prefix is meta-noise but does not erase the concrete action list.

Explicitly answers both what ('produces a risk-to-test-coverage matrix ... maps each risk ... to the tests / cases / monitoring that mitigate it') and when ('Use before a release sign-off or compliance audit, when the team must show which tests, cases, or monitors back each registered risk'). Not below 3 because a clear 'Use ...' trigger clause is present rather than only implied.

Natural domain triggers a user would actually say — 'release sign-off', 'compliance audit', 'which risks have nothing behind them'. Not below 3 because the 'Use before a release sign-off or compliance audit' clause covers the common ways this need surfaces.

Clear niche — risk-to-test-coverage mapping — explicitly distinguished from the requirements-side 'traceability-matrix-builder'. Not below 3 because the triggers are specific enough that this would not fire for a generic test or risk skill.