agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, interview transcript
$ npx -y skills add trailofbits/skills --skill interpreting-culture-index --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/interpreting-culture-indexContext preview
The summary Claude sees to decide when to auto-load this skill.
Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, interview transcript
name: interpreting-culture-index description: Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data. Supports individual profile interpretation, team composition analysis (gas/brake/glue), burnout detection, profile comparison, hiring profiles, manager coaching, interview transcript analysis for trait prediction, candidate debrief, onboarding planning, and conflict mediation. Accepts extracted JSON or PDF input via OpenCV extraction script. allowed-tools: Bash Read Grep Glob Write
<essential_principles>
**Culture Index measures behavioral traits, not intelligence or skills. There is no "good" or "bad" profile.**
<principle name="never-compare-absolutes"> **Never compare absolute trait values between people.**
The 0-10 scale is just a ruler. What matters is **distance from the red arrow** (population mean at 50th percentile). The arrow position varies between surveys based on EU.
**Why the arrow moves:** Higher EU scores cause the arrow to plot further right; lower EU causes it to plot further left. This does not affect validity—we always measure distance from wherever the arrow lands.
**Wrong**: "Dan has higher autonomy than Jim because his A is 8 vs 5" **Right**: "Dan is +3 centiles from his arrow; Jim is +1 from his arrow"
Always ask: Where is the arrow, and how far is the dot from it? </principle>
<principle name="survey-vs-job"> **Survey = who you ARE. Job = who you're TRYING TO BE.**
> **"You can't send a duck to Eagle school."** Traits are hardwired—you can only modify behaviors temporarily, at the cost of energy.
Large differences between graphs indicate behavior modification, which drains energy and causes burnout if sustained 3-6+ months. </principle>
<principle name="distance-interpretation"> **Distance from arrow determines trait strength.**
| Distance | Label | Percentile | Interpretation | |----------|-------|------------|----------------| | On arrow | Normative | 50th | Flexible, situational | | ±1 centile | Tendency | ~67th | Easier to modify | | ±2 centiles | Pronounced | ~84th | Noticeable difference | | ±4+ centiles | Extreme | ~98th | Hardwired, compulsive, predictable |
**Key insight:** Every 2 centiles of distance = 1 standard deviation.
Extreme traits drive extreme results but are harder to modify and less relatable to average people. </principle>
<principle name="l-and-i-exception"> **L (Logic) and I (Ingenuity) use absolute values.**
Unlike A, B, C, D, you CAN compare L and I scores directly between people:
Only these two traits break the "no absolute comparison" rule. </principle>
</essential_principles>
<input_formats>
**JSON (Use if available)**
If JSON data is already extracted, use it directly:
import json
with open("person_name.json") as f:
profile = json.load(f)JSON format:
{
"name": "Person Name",
"archetype": "Architect",
"survey": {
"eu": 21,
"arrow": 2.3,
"a": [5, 2.7],
"b": [0, -2.3],
"c": [1, -1.3],
"d": [3, 0.7],
"logic": [5, null],
"ingenuity": [2, null]
},
"job": { "..." : "same structure as survey" },
"analysis": {
"energy_utilization": 148,
"status": "stress"
}
}Note: Trait values are `[absolute, relative_to_arrow]` tuples. Use the relative value for interpretation.
Check same directory as PDF for matching `.json` file, or ask user if they have extracted JSON.
**PDF Input (MUST EXTRACT FIRST)**
⚠️ **NEVER use visual estimation for trait values.** Visual estimation has 20-30% error rate.
When given a PDF: 1. Check if JSON already exists (same directory as PDF, or ask user) 2. If not, run extraction with verification:
uv run --no-project {baseDir}/scripts/extract_pdf.py --verify /path/to/file.pdf [output.json]3. Visually confirm the verification summary matches the PDF 4. Use the extracted JSON for interpretation
**If uv is not installed:** Stop and instruct user to install it (`brew install uv` or `curl -LsSf https://astral.sh/uv/install.sh | sh`). Do NOT fall back to vision.
**PDF Vision (Reference Only)**
Vision may be used ONLY to verify extracted values look reasonable, NOT to extract trait scores.
</input_formats>
<intake>
**Step 0: Do you have JSON or PDF?**
1. **If JSON provided or found:** Use it directly (skip extraction)
2. **If only PDF:** Run extraction script with `--verify` flag
uv run --no-project {baseDir}/scripts/extract_pdf.py --verify /path/to/file.pdf [output.json]3. **If extraction fails:** Report error, do NOT fall back to vision
**Step 1: What data do you have?**
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems,…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls,…