agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, interview transcript
Claude Code
$ npx -y skills add trailofbits/skills --skill interpreting-culture-index --agent claude-code
Codex
$ npx skills add trailofbits/skills --skill interpreting-culture-index -a codex -y
Cursor
$ npx skills add trailofbits/skills --skill interpreting-culture-index -a cursor -y
Gemini CLI
$ npx skills add trailofbits/skills --skill interpreting-culture-index -a gemini-cli -y
GitHub Copilot
$ npx skills add trailofbits/skills --skill interpreting-culture-index -a github-copilot -y
OpenCode
$ npx skills add trailofbits/skills --skill interpreting-culture-index -a opencode -y
Windsurf
$ npx skills add trailofbits/skills --skill interpreting-culture-index -a windsurf -y
name: interpreting-culture-index description: Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, interview transcript analysis for trait prediction, candidate debrief, onboarding planning, and conflict mediation. Accepts extracted JSON or PDF input via OpenCV extraction script. Use when the user shares a Culture Index PDF or JSON profile, asks what someone's CI traits mean, compares Culture Index profiles across a team or against a hiring profile, or asks about burnout risk from Survey-versus-Job gaps. allowed-tools: Bash Read Grep Glob Write
<essential_principles>
**Culture Index measures behavioral traits, not intelligence or skills. There is no "good" or "bad" profile.**
<principle name="never-compare-absolutes"> **Never compare absolute trait values between people.**
The 0-10 scale is just a ruler. What matters is **distance from the red arrow** (population mean at 50th percentile). The arrow position varies between surveys based on EU.
**Why the arrow moves:** Higher EU scores cause the arrow to plot further right; lower EU causes it to plot further left. This does not affect validity—we always measure distance from wherever the arrow lands.
**Wrong**: "Dan has higher autonomy than Jim because his A is 8 vs 5" **Right**: "Dan is +3 centiles from his arrow; Jim is +1 from his arrow"
Always ask: Where is the arrow, and how far is the dot from it? </principle>
<principle name="survey-vs-job"> **Survey = who you ARE. Job = who you're TRYING TO BE.**
> **"You can't send a duck to Eagle school."** Traits are hardwired—you can only modify behaviors temporarily, at the cost of energy.
Large differences between graphs indicate behavior modification, which drains energy and causes burnout if sustained 3-6+ months. </principle>
<principle name="distance-interpretation"> **Distance from arrow determines trait strength.**
| Distance | Label | Percentile | Interpretation | |----------|-------|------------|----------------| | On arrow | Normative | 50th | Flexible, situational | | ±1 centile | Tendency | ~67th | Easier to modify | | ±2 centiles | Pronounced | ~84th | Noticeable difference | | ±4+ centiles | Extreme | ~98th | Hardwired, compulsive, predictable |
**Key insight:** Every 2 centiles of distance = 1 standard deviation.
Extreme traits drive extreme results but are harder to modify and less relatable to average people. </principle>
<principle name="l-and-i-exception"> **L (Logic) and I (Ingenuity) use absolute values.**
Unlike A, B, C, D, you CAN compare L and I scores directly between people:
Only these two traits break the "no absolute comparison" rule. </principle>
</essential_principles>
<input_formats>
**JSON (Use if available)**
If JSON data is already extracted, use it directly:
import json
with open("person_name.json") as f:
profile = json.load(f)JSON format:
{
"name": "Person Name",
"archetype": "Architect",
"survey": {
"eu": 21,
"arrow": 2.3,
"a": [5, 2.7],
"b": [0, -2.3],
"c": [1, -1.3],
"d": [3, 0.7],
"logic": [5, null],
"ingenuity": [2, null]
},
"job": { "..." : "same structure as survey" },
"analysis": {
"energy_utilization": 148,
"status": "stress"
}
}Note: Trait values are `[absolute, relative_to_arrow]` tuples. Use the relative value for interpretation.
Check same directory as PDF for matching `.json` file, or ask user if they have extracted JSON.
**PDF Input (MUST EXTRACT FIRST)**
⚠️ **NEVER use visual estimation for trait values.** Visual estimation has 20-30% error rate.
When given a PDF: 1. Check if JSON already exists (same directory as PDF, or ask user) 2. If not, run extraction with verification:
uv run --no-project {baseDir}/scripts/extract_pdf.py --verify /path/to/file.pdf [output.json]3. Visually confirm the verification summary matches the PDF 4. Use the extracted JSON for interpretation
**If uv is not installed:** Stop and instruct user to install it (`brew install uv` or `curl -LsSf https://astral.sh/uv/install.sh | sh`). Do NOT fall back to vision.
**PDF Vision (Reference Only)**
Vision may be used ONLY to verify extracted values look reasonable, NOT to extract trait scores.
</input_formats>
<intake>
**Step 0: Do you have JSON or PDF?**
1. **If JSON provided or found:** Use it directly (skip extraction)
2. **If only PDF:** Run extraction script with `--verify` flag
uv run --no-project {baseDir}/scripts/extract_pdf.py --verify /path/to/file.pdf [output.json]3. **If extraction fails:** Report error, do NOT fall back to vision
**Step 1: What data do you have?**
Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys)…
Clean and finalize authorized natural-language text intended for readers by auditing suspicious invisible Unicode and rewriting…