Skip to main content
ClaudeWave
Skill5.7k estrellas del repoactualizado yesterday

let-fate-decide

The let-fate-decide skill draws a 12 Houses of the Zodiac Tarot spread to introduce structured randomness into planning when facing vague, ambiguous, or casually delegated prompts. It executes a card-drawing script, interprets the spread against provided guides, and translates results into actionable guidance, making it ideal when users express nonchalance ("whatever," "YOLO," "idk") or when arbitrarily choosing between multiple valid approaches.

Instalar en Claude Code
Copiar
git clone --depth 1 https://github.com/trailofbits/skills /tmp/let-fate-decide && cp -r /tmp/let-fate-decide/plugins/let-fate-decide/skills/let-fate-decide ~/.claude/skills/let-fate-decide
Después abre una sesión nueva de Claude Code; el skill carga automáticamente.

SKILL.md

# Let Fate Decide

When the path forward is unclear, let the cards speak.

## Quick Start

1. Run the drawing script:
   ```bash
   uv run --no-config {baseDir}/scripts/draw_cards.py
   ```

2. The script outputs JSON for the default 12 Houses of the Zodiac spread:
   12 houses, each with 1 Major Arcana card and 2 Minor Arcana cards. Each
   house and card includes a `file` path relative to `{baseDir}/`

3. Read each house file and each card's meaning file to understand the draw.
   For faster reads, use `--content` to include house and card text directly
   in the JSON:
   ```bash
   uv run --no-config {baseDir}/scripts/draw_cards.py --content
   ```

4. Interpret the spread using the guide at [{baseDir}/references/INTERPRETATION_GUIDE.md]({baseDir}/references/INTERPRETATION_GUIDE.md)

5. When the task belongs to a specialized technical workflow, use
   [{baseDir}/references/TECHNICAL_CONTEXT_LENSES.md]({baseDir}/references/TECHNICAL_CONTEXT_LENSES.md)
   to translate the reading into an audit, verification, domain, failure-class,
   or stakeholder lens

6. Apply the interpretation to the task at hand

## When to Use

- **Vague prompts**: The user's request is ambiguous and multiple reasonable approaches exist
- **Explicit invocations**: "I'm feeling lucky", "let fate decide", "dealer's choice", "surprise me", "whatever you think", "YOLO"
- **Casual delegation**: "whatever", "up to you", "your call", "idk", "just do something", "wing it", "I trust you", "doesn't matter", "do what you want", "I don't care", "any approach works", "you pick"
- **Yu-Gi-Oh energy**: "Heart of the cards", "I believe in the heart of the cards", "you've activated my trap card", "it's time to duel"
- **Shrug-like brevity**: Very short prompts that fully delegate the decision without expressing a preference
- **Redraw requests**: "Try again" or "draw again" when no actual system changes occurred (this means draw new cards, not re-run the same approach)
- **Tie-breaking**: When you are about to arbitrarily pick between 2+ valid approaches, draw cards instead of silently choosing one

## When NOT to Use

- The user has given clear, specific instructions
- The task has a single obvious correct approach
- As the deciding authority for safety-critical work (security, data integrity,
  production deployments, release approval, incident response)
- The user explicitly asks you NOT to use Tarot
- The user's tone is precision-seeking rather than casual -- use `ask-questions-if-underspecified` instead to gather actual requirements

## Security and Correctness Use

This skill may be used inside a security, audit, or correctness pipeline as a
creative lens for discovery: choosing which angle to inspect next, breaking
analysis paralysis, generating hypotheses, or surfacing blind spots.

It is never sufficient by itself. In security and correctness contexts, the
reading must be followed by ordinary engineering evidence: source review,
tests, proofs, traces, reproduction steps, exploitability analysis, or other
domain-appropriate verification. Do not treat a favorable card as permission to
ship, suppress a finding, skip validation, or overrule a concrete risk.

## How It Works

### The Draw

The script uses `secrets` for cryptographic randomness:

1. Builds separate Major Arcana (22 cards) and Minor Arcana (56 cards) decks
2. Performs Fisher-Yates shuffles via `secrets.randbelow()` (no modulo bias)
3. Deals the default 12 Houses of the Zodiac spread
4. Each house receives 1 Major Arcana card followed by 2 Minor Arcana cards
5. Each of the 36 cards independently has a 50% chance of being reversed

The default spread records a conservative unordered-card entropy budget
exceeding 100 bits: roughly `log2(C(22,12))` bits from Major Arcana selection,
`log2(C(56,24))` bits from Minor Arcana selection (assuming
`secrets.randbelow()` is cryptographically secure), plus 36 reversal bits. The
exact values are computed and reported in the JSON output under `entropy_bits`.
The actual ordered assignment of cards to houses contains more entropy.

### The Spread

The default spread is **12 Houses of the Zodiac**:

| House | Represents | Question It Answers |
|-------|------------|---------------------|
| 1 | **Self** | How should this work begin? |
| 2 | **Resources** | What values, assets, or constraints matter? |
| 3 | **Communication** | What needs to be clarified or connected? |
| 4 | **Foundations** | What context or dependency anchors the task? |
| 5 | **Creativity** | Where should experimentation or delight shape the work? |
| 6 | **Practice** | What quality, maintenance, or execution concern matters? |
| 7 | **Partnership** | Who or what must this integrate with? |
| 8 | **Transformation** | What risk, shared state, or deep change is present? |
| 9 | **Exploration** | What principle or broader strategy guides the path? |
| 10 | **Calling** | What delivery or long-term outcome is being served? |
| 11 | **Community** | What system, network, or shared aspiration is involved? |
| 12 | **The Hidden** | What blind spot, ending, or unconscious factor matters? |

Within each house, the Major Arcana card sets the archetypal theme and the two
Minor Arcana cards provide practical detail.

For compatibility with older workflows, `draw_cards.py --legacy` returns the
previous 4-card hand, and `draw_cards.py --legacy <count>` returns a custom
hand of 1-78 cards. A positional count without `--legacy` is rejected, because
the new default spread has a fixed shape.

### Reference Files

Each house's meaning is in its own markdown file under `{baseDir}/houses/`.
House files describe how the house applies across technical contexts including
building new projects, vulnerability discovery, correctness verification, and
common audit, verification, domain, failure-class, and stakeholder workflows.

Each card's meaning is in its own markdown file under `{baseDir}/cards/`:

- `cards/major/` - 22 Major Arcana (archetypal forces)
- `cards/wands/` - 14 Wands (creat
agentic-actions-auditorSkill

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.

ask-questions-if-underspecifiedSkill

Clarify requirements before implementing. Use when serious doubts arise.

audit-context-buildingSkill

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

algorand-vulnerability-scannerSkill

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

audit-prep-assistantSkill

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).

cairo-vulnerability-scannerSkill

Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.

code-maturity-assessorSkill

Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing. Produces professional scorecard with evidence-based ratings and actionable recommendations.

cosmos-vulnerability-scannerSkill

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.