hmbown/heat-metal
generated/hermes/containment-and-intervention/heat-metal/SKILL.md
In D&D, Heat Metal makes a metal object painfully hot — the creature holding it must either endure the pain or drop it. The real-world version is deliberate friction injection: making a deprecated API progressively slower, adding escalating CAPTCHAs to suspicious traffic, increasing the cost of a bad behavior path until the actor self-selects out. Heat Metal does not break the tool. It makes continuing to use it more painful than switching to the alternative. This is the spell behind deprecation-by-discomfort, progressive rate limiting, and sunset friction curves.
$ install --global
skillsauthnpx skillsauth add hmbown/wizards-of-the-ghosts heat-metalInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 5, 2026, 4:46 PM4.3s1 file scanned
SKILL.md
- name:
- heat-metal
- description:
- In D&D, Heat Metal makes a metal object painfully hot — the creature holding it must either endure the pain or drop it. The real-world version is deliberate friction injection: making a deprecated API progressively slower, adding escalating CAPTCHAs to suspicious traffic, increasing the cost of a bad behavior path until the actor self-selects out. Heat Metal does not break the tool. It makes continuing to use it more painful than switching to the alternative. This is the spell behind deprecation-by-discomfort, progressive rate limiting, and sunset friction curves.
- version:
- 1.0.0
- author:
- Wizards of the Ghosts
- license:
- CC0-1.0
- compatibility:
- Hermes Agent skills system
Heat Metal
Make a tool or process increasingly uncomfortable to use until it is abandoned.
What This Skill Does
In D&D, Heat Metal makes a metal object painfully hot — the creature holding it must either endure the pain or drop it. The real-world version is deliberate friction injection: making a deprecated API progressively slower, adding escalating CAPTCHAs to suspicious traffic, increasing the cost of a bad behavior path until the actor self-selects out. Heat Metal does not break the tool. It makes continuing to use it more painful than switching to the alternative. This is the spell behind deprecation-by-discomfort, progressive rate limiting, and sunset friction curves. In this grimoire, Heat Metal is treated as a hybrid spell with a prototype delivery profile. Canonical reference input: Heat Metal (spell).
When To Use
- You want to drive migration away from a deprecated tool, API, or workflow without hard-cutting access.
- Suspicious or abusive behavior should be progressively penalized without outright blocking.
- A gradual escalation of friction is more appropriate than an immediate ban or shutdown.
Prerequisites
- No extra runtime dependencies beyond Hermes Agent and the normal toolset for this session.
Procedure
- Restate the target, the success condition, and any no-touch boundaries before taking action.
- Identify the tool, path, or behavior you want to discourage.
- Design the friction curve: what discomfort increases over time and at what rate.
- Implement the progressive friction: latency injection, CAPTCHA escalation, cost increases, warning banners.
- Monitor adoption of the preferred alternative to confirm the friction is driving the intended migration.
- Set a sunset date: Heat Metal should eventually end in either full migration or hard deprecation.
- Package the result as the deliverables below, with confidence, assumptions, and unresolved risk called out explicitly.
Deliverables
- A friction curve specification: what changes, how fast, and what the escalation stages are.
- Migration metrics: how many users/systems have moved to the preferred alternative.
- A sunset timeline with hard cutoff criteria.
Pitfalls / Guardrails
- Call out the glue, permissions, or missing infrastructure before you imply this is fully operational.
- Friction injection must be disclosed. Secretly making tools worse without explanation is a dark pattern.
- Heat Metal targets behavior, not people. Progressive friction applied to specific users as punishment crosses into harassment.
- Always provide a visible alternative. Making something painful to use without offering a better path is cruelty, not engineering.
Verification
- Check that the result includes every deliverable promised above.
- Check that confirmed facts, assumptions, and inferences are visibly separated.
- Check which parts are concrete actions versus framing, so the user can tell what is real now.
- Check that any missing glue code, permissions, or future work is labeled before the skill is treated as ready.
Example Invocation
/heat-metal design a progressive friction strategy that makes a deprecated tool, abusive pattern, or unwanted behavior increasingly uncomfortable until users migrate to the better alternative
Related Skills
hmbown/zone-of-truth
testing
VerifiedTrustedCommunity
Enter a mode where every assertion is backed by evidence, confidence is calibrated, speculation is flagged, and hallucination is actively resisted.
55SKILL.mdUpdated Apr 5, 2026
hmbown/vicious-mockery
development
VerifiedTrustedCommunity
The bard's cantrip that deals psychic damage through insults. In practice this is adversarial review — the art of finding and articulating exactly what is wrong with something in a way that is impossible to ignore. Unlike polite feedback that gets filed and forgotten, vicious mockery lands. It is the red-team report that makes the PM cancel the launch, the code review that makes the author delete the PR, the roast that makes the founder pivot. The damage is the point.
55SKILL.mdUpdated Apr 5, 2026
hmbown/unseen-servant
tools
VerifiedTrustedCommunity
Use this spell when you need a tireless helper that organizes, tidies, triages, and maintains without requiring your constant attention.
55SKILL.mdUpdated Apr 5, 2026
hmbown/true-strike
testing
VerifiedTrustedCommunity
Use this spell for preflight certainty: dry runs, validation checks, dependency verification, and rehearsals that make the next deploy, query, or command much more likely to succeed. It trades a little time up front for fewer blind swings and fewer expensive misses.
55SKILL.mdUpdated Apr 5, 2026