Content
82%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A dense, highly actionable offensive-security skill with copy-paste bash and a solid authorization decision gate. Conciseness and workflow clarity are strong; the only meaningful gap is that validation checkpoints live in a separate advisory section rather than inline with the destructive code paths.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Largely lean — code-forward with minimal preamble and no padding about what CI/CD or OIDC 'is'; a few prose explanations (trust-policy enumeration, provenance narrative) could be trimmed but every block is functional. | 4 / 5 |
Actionability | Copy-paste-ready bash across every section (env grep, 8 masking-bypass variants, OIDC mint+assume-role, GITHUB_TOKEN/GitLab job-token API calls, cache/artifact enumeration, cosign signing); commands are concrete and parameterized with the real env vars. | 5 / 5 |
Workflow Clarity | Clear sectioned progression (surface map -> masking -> env -> OIDC -> token abuse -> cache -> provenance -> detection -> decision gate) and a numbered Decision Gate with explicit validation gates (print proof not secret, don't exchange OIDC, dry-run pushes, scrub artifacts); docked one point because the destructive/batch operations lack an inline validate-before-proceed checkpoint inside the operational sections themselves (gates are advisory, separate from the code blocks). | 4 / 5 |
Progressive Disclosure | Well-organized into clearly headed sections with a Tools table and References list; no bundle files exist (references/scripts/assets absent), so there is nothing to split out, and the single-file structure is appropriate for the scope — minor gap only in that References are bare text rather than linkable paths. | 4 / 5 |
Total | 17 / 20 Passed |