The body is dense and operational — tables, executable code, and sequenced steps — and assumes Claude's competence; SOC 2 specifics (observation period, TSC scope) are legitimate domain context rather than basic concepts Claude already knows.

Provides executable Python for both the collector and the per-control test, with the injected client interfaces (okta_client, aws_iam, github_org, slack) explicitly justified as thin SDK wrappers rather than left as pseudocode.

Seven sequenced steps culminate in a checklist, with explicit verification (mock auditor query in Step 7), continuity-gap alerting in Step 6, and a worked example showing a test-fail → fix → green feedback loop for a batch operation.

Overview and code stay inline in SKILL.md while the large control-to-evidence-source and scope-decision tables are split into references/evidence-source-map.md — a real, one-level-deep, clearly signaled reference (verified present).

Lists multiple concrete actions: building per-criterion test artifacts, auto-collection from CI logs + audit trails + access logs + change-management records, GRC platform alignment, and observation-period sampling — matching the 'lists multiple specific concrete actions' anchor.

Clearly answers both 'what' (per-criterion evidence collection with named sources and GRC alignment) and 'when' via an explicit 'Use when...' trigger clause, so it is not capped at 2.

The 'Use when the team is preparing for SOC 2 Type II audit and needs continuous evidence collection automation' clause surfaces the natural terms a user would actually say (SOC 2 Type II audit, evidence collection, Vanta/Drata/Secureframe), giving good coverage despite the internal 'Build-an-X' jargon prefix.

Scoped tightly to SOC 2 Type II evidence collection with distinct triggers (TSC criteria, Vanta/Drata/Secureframe, observation-period sampling), making conflict with other skills unlikely.