agentic-actions-audito…
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases,
$ npx -y skills add trailofbits/skills --skill let-fate-decide --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
/let-fate-decideContext preview
The summary Claude sees to decide when to auto-load this skill.
Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases,
name: let-fate-decide description: "Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases, makes Yu-Gi-Oh references, or when you are about to arbitrarily pick between multiple reasonable approaches. Prefer over asking clarifying questions when the user's tone is casual or playful rather than precision-seeking." allowed-tools: Bash Read Grep Glob
When the path forward is unclear, let the cards speak.
1. Run the drawing script:
uv run --no-config {baseDir}/scripts/draw_cards.py2. The script outputs JSON for the default 12 Houses of the Zodiac spread: 12 houses, each with 1 Major Arcana card and 2 Minor Arcana cards. Each house and card includes a `file` path relative to `{baseDir}/`
3. Read each house file and each card's meaning file to understand the draw. For faster reads, use `--content` to include house and card text directly in the JSON:
uv run --no-config {baseDir}/scripts/draw_cards.py --content4. Interpret the spread using the guide at [{baseDir}/references/INTERPRETATION_GUIDE.md]({baseDir}/references/INTERPRETATION_GUIDE.md)
5. When the task belongs to a specialized technical workflow, use [{baseDir}/references/TECHNICAL_CONTEXT_LENSES.md]({baseDir}/references/TECHNICAL_CONTEXT_LENSES.md) to translate the reading into an audit, verification, domain, failure-class, or stakeholder lens
6. Apply the interpretation to the task at hand
production deployments, release approval, incident response)
This skill may be used inside a security, audit, or correctness pipeline as a creative lens for discovery: choosing which angle to inspect next, breaking analysis paralysis, generating hypotheses, or surfacing blind spots.
It is never sufficient by itself. In security and correctness contexts, the reading must be followed by ordinary engineering evidence: source review, tests, proofs, traces, reproduction steps, exploitability analysis, or other domain-appropriate verification. Do not treat a favorable card as permission to ship, suppress a finding, skip validation, or overrule a concrete risk.
The script uses `secrets` for cryptographic randomness:
1. Builds separate Major Arcana (22 cards) and Minor Arcana (56 cards) decks 2. Performs Fisher-Yates shuffles via `secrets.randbelow()` (no modulo bias) 3. Deals the default 12 Houses of the Zodiac spread 4. Each house receives 1 Major Arcana card followed by 2 Minor Arcana cards 5. Each of the 36 cards independently has a 50% chance of being reversed
The default spread records a conservative unordered-card entropy budget exceeding 100 bits: roughly `log2(C(22,12))` bits from Major Arcana selection, `log2(C(56,24))` bits from Minor Arcana selection (assuming `secrets.randbelow()` is cryptographically secure), plus 36 reversal bits. The exact values are computed and reported in the JSON output under `entropy_bits`. The actual ordered assignment of cards to houses contains more entropy.
The default spread is **12 Houses of the Zodiac**:
| House | Represents | Question It Answers | |-------|------------|---------------------| | 1 | **Self** | How should this work begin? | | 2 | **Resources** | What values, assets, or constraints matter? | | 3 | **Communication** | What needs to be clarified or connected? | | 4 | **Foundations** | What context or dependency anchors the task? | | 5 | **Creativity** | Where should experimentation or delight shape the work? | | 6 | **Practice** | What quality, maintenance, or execution concern matters? | | 7 | **Partnership** | Who or what must this integrate with? | | 8 | **Transformation** | What risk, shared state, or deep change is present? | | 9 | **Exploration** | What principle or broader strategy guides the path? | | 10 | **Calling** | What delivery or long-term outcome is being served? | | 11 | **Community** | What system, network, or shared aspiration is involved? | | 12 | **The Hidden** | What blind spot, ending, or unconscious factor matters? |
Within each house, the Major Arcana card sets the archetypal theme and the two Minor Arcana cards provide practical detail.
For compatibility with older workflows, `draw_cards.py --legacy` returns the previous 4-card hand, and `draw_cards.py --legacy <count>` returns a custom hand of 1-78 cards. A positional count without `--le
A Claude Code plugin marketplace from Trail of Bits providing skills to enhance AI-assisted security analysis, testing, and development workflows. Codex can load this marketplace through its Claude marketplace compatibility.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI…
Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an…
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access…
Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes…
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems,…
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls,…