let-fate-decide

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, brainstorming, evaluation, priority, strategy.

What it does

Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases, makes Yu-Gi-Oh references, or when you are about to arbitrarily pick between multiple reasonable approaches. Prefer over asking clarifying questions when the user's tone is casual or playful rather than precision-seeking.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill let-fate-decide

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/let-fate-decide/skills/let-fate-decide ~/.claude/skills/let-fate-decide

Safety box score

Grade B, low risk: 19 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a local Tarot-style decision aid: it runs a shipped Python draw script and reads markdown meaning files under the skill directory. The main risks are limited code execution through `uv run`, local file access for card/house content, and a strong policy bias toward using the reading instead of asking clarifying questions in casual cases.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly runs repository code with `uv run --no-config {baseDir}/scripts/draw_cards.py`, and the shipped `scripts/draw_cards.py` is an executable Python program.
Network access	0 (none)	No outbound network calls or downloads are present; the script reads local files only and uses `secrets` for local randomness, not remote communication.
Filesystem reach	1 (low)	`scripts/draw_cards.py` reads markdown from `cards/...` and `houses/...` (for example `open(path)` and `read_reference_file`), but it stays within the skill tree and does not write or delete outside it.
Secrets & credentials	0 (none)	The skill uses the standard `secrets` module for randomness, but it does not read or request tokens, passwords, keychains, `.env` files, or browser sessions.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, shell startup editing, or OS-level configuration change.
Instruction hijack surface	1 (low)	It tells the agent to use the skill for casual delegation and to `Prefer over asking clarifying questions when the user's tone is casual or playful`, which can suppress ordinary clarification, though it also says not to use it for safety-critical decisions.
Irreversible actions	1 (low)	The workflow asks the agent to apply the interpretation to the task and says `Never output interpretation as a text-only turn`, nudging immediate action, but it does not itself send messages, deploy, pay, or delete anything.
Transparency	0 (none)	All shipped code and content are readable text files; there are no binaries, base64 blobs, or unpinned remote installs in the provided skill.

Before installing

Read `scripts/draw_cards.py` to confirm you are comfortable executing a shipped Python script with `uv run`.
Check whether you want a tool that may replace clarifying questions when prompts are casual or vague.
Run `uv run --no-config scripts/draw_cards.py --content` in a scratch environment and verify it only reads local files.
Review `scripts/test_draw_cards.py` to see the exact behaviors the skill is designed to preserve.

Rated 2026-09-22 by an automated review of 98 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/let-fate-decide/skills/let-fate-decide/SKILL.md
Branch: main
Collection: let-fate-decide
Updated: 2026-09-19

interpreting-culture-index — Interprets Culture Index (CI) surveys, behavioral profiles, and personality assessment data.
the-fool — Use when challenging ideas, plans, decisions, or proposals using structured critical reasoning.
arena — Spawn N parallel candidates at the same task, pick a base, graft the strongest parts of the losers into it.
marketing-council — When the user wants multiple expert perspectives on a marketing question — a simulated board of advisors staffed by legendary marketers (Seth Godin.
principle-attack-the-premise — Apply when two or more fixes that share one premise have failed the same gate.
feature-forge — Conducts structured requirements workshops to produce feature specifications, user stories, EARS-format functional requirements, acceptance criteria.