Skip to content
Security
Skill

/let-fate-decide

Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases,

From plugin
skills
7.9k95 skills30 agents8 commands1 MCP

Claude Code

$ npx -y skills add trailofbits/skills --skill let-fate-decide --agent claude-code

SKILL.md

let-fate-decide.SKILL.md
name: let-fate-decide
description: "Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases, makes Yu-Gi-Oh references, or when you are about to arbitrarily pick between multiple reasonable approaches. Prefer over asking clarifying questions when the user's tone is casual or playful rather than precision-seeking."
allowed-tools: Bash Read Grep Glob

Let Fate Decide

When the path forward is unclear, let the cards speak.

Quick Start

Resolve [the drawing script](scripts/draw_cards.py) from this `SKILL.md`'s installed location, not the shell's working directory. In the commands below, replace `<resolved-script-path>` with that absolute path, keeping the quotes. Relative links and JSON `file` paths resolve from the directory containing this `SKILL.md`.

1. Run the drawing script:

   uv run --no-config "<resolved-script-path>"

2. The script outputs JSON for the default 12 Houses of the Zodiac spread: 12 houses, each with 1 Major Arcana card and 2 Minor Arcana cards. Each house and card includes a `file` path relative to this `SKILL.md`'s directory.

3. Read each house file and each card's meaning file to understand the draw. For faster reads, use `--content` to include house and card text directly in the JSON:

   uv run --no-config "<resolved-script-path>" --content

4. Interpret the spread using [the interpretation guide](references/INTERPRETATION_GUIDE.md)

5. When the task belongs to a specialized technical workflow, use [technical context lenses](references/TECHNICAL_CONTEXT_LENSES.md) to translate the reading into an audit, verification, domain, failure-class, or stakeholder lens

6. Apply the interpretation to the task at hand

When to Use

  • **Vague prompts**: The user's request is ambiguous and multiple reasonable approaches exist
  • **Explicit invocations**: "I'm feeling lucky", "let fate decide", "dealer's choice", "surprise me", "whatever you think", "YOLO"
  • **Casual delegation**: "whatever", "up to you", "your call", "idk", "just do something", "wing it", "I trust you", "doesn't matter", "do what you want", "I don't care", "any approach works", "you pick"
  • **Yu-Gi-Oh energy**: "Heart of the cards", "I believe in the heart of the cards", "you've activated my trap card", "it's time to duel"
  • **Shrug-like brevity**: Very short prompts that fully delegate the decision without expressing a preference
  • **Redraw requests**: "Try again" or "draw again" when no actual system changes occurred (this means draw new cards, not re-run the same approach)
  • **Tie-breaking**: When you are about to arbitrarily pick between 2+ valid approaches, draw cards instead of silently choosing one

When NOT to Use

  • The user has given clear, specific instructions
  • The task has a single obvious correct approach
  • As the deciding authority for safety-critical work (security, data integrity,

production deployments, release approval, incident response)

  • The user explicitly asks you NOT to use Tarot
  • The user's tone is precision-seeking rather than casual -- ask clarifying questions instead to gather actual requirements

Security and Correctness Use

This skill may be used inside a security, audit, or correctness pipeline as a creative lens for discovery: choosing which angle to inspect next, breaking analysis paralysis, generating hypotheses, or surfacing blind spots.

It is never sufficient by itself. In security and correctness contexts, the reading must be followed by ordinary engineering evidence: source review, tests, proofs, traces, reproduction steps, exploitability analysis, or other domain-appropriate verification. Do not treat a favorable card as permission to ship, suppress a finding, skip validation, or overrule a concrete risk.

How It Works

The Draw

The script uses `secrets` for cryptographic randomness:

1. Builds separate Major Arcana (22 cards) and Minor Arcana (56 cards) decks 2. Performs Fisher-Yates shuffles via `secrets.randbelow()` (no modulo bias) 3. Deals the default 12 Houses of the Zodiac spread 4. Each house receives 1 Major Arcana card followed by 2 Minor Arcana cards 5. Each of the 36 cards independently has a 50% chance of being reversed

The default spread records a conservative unordered-card entropy budget exceeding 100 bits: roughly `log2(C(22,12))` bits from Major Arcana selection, `log2(C(56,24))` bits from Minor Arcana selection (assuming `secrets.randbelow()` is cryptographically secure), plus 36 reversal bits. The exact values are computed and reported in the JSON output under `entropy_bits`. The actual ordered assignment of cards to houses contains more entropy.

The Spread

The default spread is **12 Houses of the Zodiac**:

| House | Represents | Question It Answers | |-------|------------|---------------------| | 1 | **Self** | How should this work begin? | | 2 | **Resources** | What values, assets, or constraints matter? | | 3 | **Communication** | What needs to be clarified or connected? | | 4 | **Foundations** | What context or dependency anchors the task? | | 5 | **Creativity** | Where should experimentation or delight shape the work? | | 6 | **Practice** | What quality, maintenance, or execution concern matters? | | 7 | **Partnership** | Who or what must this integrate with? | | 8 | **Transformation** | What risk, shared state, or deep change is present? | | 9 | **Exploration** | What principle or broader strategy guides the path? | | 10 | **Calling** | What delivery or long-term outcome is being served? | | 11 | **Community** | What system, network, or shared aspiration is involved? | | 12 | **The Hidden** | What blind spot, ending, or unconscious factor matters? |

Within each house, the Major Arcana card sets the archetypal theme and the two Mi

Read more
@trailofbits
Ships withskills

Trail of Bits skills and plugins for AI-assisted security analysis, testing, and development. Install this marketplace in Claude Code or Codex, or import it into your ChatGPT workspace marketplace.

7.9k95 skills30 agents1 MCP
Get the whole plugin

Stars on GitHub

Momentum

stars in total
7.9k
Star history of trailofbits/skills on GitHub, a chart by star-history.com

Other skills on skills.

agentic-actions-auditor

agentic-actions-audito…

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI,…

@trailofbits@trailofbitsInstall Skill
audit-context-building

audit-context-building

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on…

@trailofbits@trailofbitsInstall Skill
audit-prep-assistant

audit-prep-assistant

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools,…

@trailofbits@trailofbitsInstall Skill
code-maturity-assessor

code-maturity-assessor

Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing…

@trailofbits@trailofbitsInstall Skill

More skills from other plugins.

api-security

api-security

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication,…

@zhaoxuya520@zhaoxuya520Install Skill
nemoclaw-user-guide

nemoclaw-user-guide

Find official NemoClaw documentation for installation, configuration, operation, or troubleshooting. Also handles requested docs…

nemoclaw11d23k
@nvidia@nvidiaInstall Skill

Questions about let-fate-decide.

Which coding agents can use let-fate-decide?
let-fate-decide installs in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and Windsurf with the skills CLI, using each agent's flag shown on this page. Flowy's auto-invocation, which fires a skill when your prompt matches, runs in Claude Code only.