Dense, command-driven body that assumes Claude's competence — no padding about what CI/CD or masking is, with every prose note (substring-based masking, deterministic OIDC sub claim) earning its place.

Provides fully executable, copy-paste-ready bash throughout — surface-map enumeration, eight masking-bypass variants, the OIDC mint/assume-role exchange, and token-abuse commands — with concrete tool names in tables.

Organized as a technique catalog rather than a strictly sequenced pipeline; the trailing Decision Gate provides explicit checkpoints (print proof not secret, dry-run artifacts, scrub before done), but the main flow lacks a clear validate→fix→retry sequence.

A single monolithic file with well-labeled sections but no bundle files or one-level-deep references; content that could be split (detection signatures, tool reference, OIDC detail) is all inline.

Lists many concrete actions — 'echo/printenv exfil, log-masking bypass (base64, char-split, reversal), OIDC token abuse to assume cloud roles, GITHUB_TOKEN / CI_JOB_TOKEN scope abuse, cache / artifact secret leakage, provenance pivot' — matching the multiple-specific-actions anchor.

Clearly states what the skill does but lacks any 'Use when...' clause or explicit trigger guidance, so per the judging guidelines completeness is capped at 2.

Uses the natural terms practitioners say for this niche — 'ci secrets', 'oidc tokens', 'GITHUB_TOKEN', 'CI_JOB_TOKEN', 'base64' — giving good coverage of relevant keywords rather than generic jargon.

A sharply defined niche (CI/CD secrets + OIDC exfiltration from a build job) with distinct, specific triggers that are unlikely to overlap with unrelated skills.