external/trailofbits-security/let-fate-decide/skills/let-fate-decide/SKILL.md
Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases, makes Yu-Gi-Oh references, or when you are about to arbitrarily pick between multiple reasonable approaches. Prefer over ask-questions-if-underspecified when the user's tone is casual or playful rather than precision-seeking.
npx skillsauth add seikaikyo/dash-skills let-fate-decideInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
When the path forward is unclear, let the cards speak.
Run the drawing script:
uv run --no-config {baseDir}/scripts/draw_cards.py
The script outputs JSON for the default 12 Houses of the Zodiac spread:
12 houses, each with 1 Major Arcana card and 2 Minor Arcana cards. Each
house and card includes a file path relative to {baseDir}/
Read each house file and each card's meaning file to understand the draw.
For faster reads, use --content to include house and card text directly
in the JSON:
uv run --no-config {baseDir}/scripts/draw_cards.py --content
Interpret the spread using the guide at {baseDir}/references/INTERPRETATION_GUIDE.md
When the task belongs to a specialized technical workflow, use {baseDir}/references/TECHNICAL_CONTEXT_LENSES.md to translate the reading into an audit, verification, domain, failure-class, or stakeholder lens
Apply the interpretation to the task at hand
ask-questions-if-underspecified instead to gather actual requirementsThis skill may be used inside a security, audit, or correctness pipeline as a creative lens for discovery: choosing which angle to inspect next, breaking analysis paralysis, generating hypotheses, or surfacing blind spots.
It is never sufficient by itself. In security and correctness contexts, the reading must be followed by ordinary engineering evidence: source review, tests, proofs, traces, reproduction steps, exploitability analysis, or other domain-appropriate verification. Do not treat a favorable card as permission to ship, suppress a finding, skip validation, or overrule a concrete risk.
The script uses secrets for cryptographic randomness:
secrets.randbelow() (no modulo bias)The default spread records a conservative unordered-card entropy budget
exceeding 100 bits: roughly log2(C(22,12)) bits from Major Arcana selection,
log2(C(56,24)) bits from Minor Arcana selection (assuming
secrets.randbelow() is cryptographically secure), plus 36 reversal bits. The
exact values are computed and reported in the JSON output under entropy_bits.
The actual ordered assignment of cards to houses contains more entropy.
The default spread is 12 Houses of the Zodiac:
| House | Represents | Question It Answers | |-------|------------|---------------------| | 1 | Self | How should this work begin? | | 2 | Resources | What values, assets, or constraints matter? | | 3 | Communication | What needs to be clarified or connected? | | 4 | Foundations | What context or dependency anchors the task? | | 5 | Creativity | Where should experimentation or delight shape the work? | | 6 | Practice | What quality, maintenance, or execution concern matters? | | 7 | Partnership | Who or what must this integrate with? | | 8 | Transformation | What risk, shared state, or deep change is present? | | 9 | Exploration | What principle or broader strategy guides the path? | | 10 | Calling | What delivery or long-term outcome is being served? | | 11 | Community | What system, network, or shared aspiration is involved? | | 12 | The Hidden | What blind spot, ending, or unconscious factor matters? |
Within each house, the Major Arcana card sets the archetypal theme and the two Minor Arcana cards provide practical detail.
For compatibility with older workflows, draw_cards.py --legacy returns the
previous 4-card hand, and draw_cards.py --legacy <count> returns a custom
hand of 1-78 cards. A positional count without --legacy is rejected, because
the new default spread has a fixed shape.
Each house's meaning is in its own markdown file under {baseDir}/houses/.
House files describe how the house applies across technical contexts including
building new projects, vulnerability discovery, correctness verification, and
common audit, verification, domain, failure-class, and stakeholder workflows.
Each card's meaning is in its own markdown file under {baseDir}/cards/:
cards/major/ - 22 Major Arcana (archetypal forces)cards/wands/ - 14 Wands (creativity, action, will)cards/cups/ - 14 Cups (emotion, intuition, relationships)cards/swords/ - 14 Swords (intellect, conflict, truth)cards/pentacles/ - 14 Pentacles (material, practical, craft)After drawing, read each house file and each card file, then synthesize meaning. See {baseDir}/references/INTERPRETATION_GUIDE.md for the full interpretation workflow. For cross-domain translation, see {baseDir}/references/TECHNICAL_CONTEXT_LENSES.md.
Key rules:
--content so all 36 card
meanings and all 12 house meanings are available from the draw output.A real reading synthesizes all 12 houses; the fragment below shows only what one house contributes so the format is clear. Do not stop after one house in actual use.
User: "I dunno, just make it work somehow"
[Draw cards]
1st House (Self): The Magician (upright), Five of Swords (reversed),
Ten of Pentacles (upright)
House contribution: The starting stance is resourceful and tool-rich
(Magician), but the practical details warn against combative edge-case work
(Five of Swords reversed) while still favoring maintainable craft
(Ten of Pentacles). This is one input into the overall reading; combine with
the remaining 11 houses before deciding on an approach.
The named draw agent returns a more compact form for portent questions:
3 concise bullets covering the dominant theme, the main risk or blind spot,
and the recommended next action.
If the drawing script fails:
| Rationalization | Why Wrong | |----------------|-----------| | "The cards said to, so I must" | Cards inform direction, they don't override safety or correctness | | "This reading justifies my pre-existing preference" | Be honest if the reading challenges your instinct | | "The reversed card means do nothing" | Reversed means a different angle, not inaction | | "Major Arcana overrides user requirements" | User requirements always take priority over card readings | | "I'll keep drawing until I get what I want" | One draw per decision point; accept the reading | | "The reading says the risk is fine" | Cards can suggest what to inspect; only evidence can dismiss a security or correctness concern |
development
拋棄式 HTML mockup 比稿:產出 2 到 3 個設計立場不同的變體(密度 / 版式 / 強調軸,不是換色),各附取捨說明,最後給有立場的對比結論。適用:「畫個草圖」「比較 A 版 B 版」「先看方向再做」「給我看幾種做法」。要 production 元件或設計已定案時不適用。
tools
需求不明時的意圖萃取訪談:一次一題、每題附上自己的猜測、聽出「真正想要 vs 覺得應該要」,直到能預測使用者反應(約 95% 信心)才動工。適用:需求缺少對象 / 動機 / 成功標準 / 約束,或使用者點名「訪談我」「先確認一下」「我們確定嗎」。明確自足的指示、純資訊查詢、機械性操作不適用。
development
對非平凡決策啟動新鮮 context 對抗審查(找碴不背書),在修正還便宜的時候抓出錯誤方向。適用:高風險改動(production、資安敏感邏輯、不可逆操作)、不熟的程式碼、要宣稱「這樣是安全的 / 可行的」之前。機械性操作與一行修改不適用。
testing
Reference for writing and editing agent skills well — the vocabulary and principles that make a skill predictable. Consult when authoring, reviewing, or pruning a SKILL.md.