Lean decision-surface document that assumes Claude's competence, with no padding or explanation of basic concepts; its length reflects genuine task complexity rather than verbosity.

Provides fully executable CLI commands for all three scanners and a copy-paste-ready waiver YAML template with concrete field names, all directly runnable.

Clear numbered sequence (Steps 1-5, with 2a/2b/2c sub-steps) plus explicit validation checkpoints (finding-triage rejects expired/malformed waivers) and an anti-patterns table as error-recovery guidance.

SKILL.md acts as a concise overview with well-signaled, one-level-deep references to waiver-lifecycle.md and baseline-rot-prevention.md, both of which are real files; content is appropriately split.

Lists multiple concrete actions ('Builds and maintains a unified secrets baseline/allowlist', 'adopts legacy findings', 'enforces a waiver lifecycle', 'prevents baseline rot via quarterly audit') with named scanner mechanisms.

Explicitly answers both what (unified baseline + waiver lifecycle + rot prevention) and when via a clear 'Use when onboarding... or when... drifted out of sync' clause.

Has relevant trigger phrasings ('onboarding secrets scanning', 'per-scanner ignore configs have drifted out of sync') but leans technical/internal and misses more common surface-level variations a user might say.

A sharply defined niche (cross-scanner secrets baseline governance across three named tools) that is clearly distinct from the per-scanner scanning skills and unlikely to trigger for the wrong skill.