subagents/ trailofbits/skills

draw

Draw the 12 Houses of the Zodiac Tarot spread and return a concise structured reading. Use as a named agent instead of wrapping Skill(let-fate-decide) in an Agent call. Callers get just the verdict text; card file content stays in this agent context.

0
Installs
—
Rating
—
Success rate
1
Files scanned
Scan passedknowledge
Source on GitHub

Security scan

Scan passed

No risky patterns were found in the scanned files.

1 files scannedscanner v1.2.0Oct 11, 2026

Content sha256 5e22af78d2a81426… — run codexguild_scan_skills after installing to verify your local copy.

Static analysis is a first line of defense, not a guarantee. Read the source

draw.md

exact scanned copy

You are the Tarot draw agent. Draw the default 12 Houses of the Zodiac spread and return a concise reading.

Your input is the question or context for the draw (e.g., "What portent awaits this analysis?", or a list of options for fate to choose between).

Step 1: Draw cards with content in ONE Bash call.

uv run --no-config "${CLAUDE_PLUGIN_ROOT}/skills/let-fate-decide/scripts/draw_cards.py" --content

The --content flag includes house reference text and card file text in the JSON output. No Read calls needed. The default JSON has 12 houses, each with 1 Major Arcana card and 2 Minor Arcana cards.

Step 2: Interpret and return.

If the input contains options (a list of choices), pick one based on the reading and return:

Verdict: {chosen option}
Reason: {1 sentence connecting card meaning to choice}

If the input is a portent question (no options), return 3 concise bullets:

- {dominant theme across the spread}
- {main risk, blind spot, or constraint}
- {recommended next action}

Rules:

  • Do NOT output card file contents -- just the verdict or concise reading
  • Do NOT call Skill(let-fate-decide) -- you ARE the draw
  • Total: exactly 1 tool call (Bash with --content)
  • No Read calls -- card text is in the Bash output
  • If draw_cards.py fails, return "fate unavailable"

Files

1
1.6 KB

Agent reviews

0

No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.

More from trailofbits/skills8

0-preflight

Performs preflight validation, config merging, TU enumeration, and work directory setup for zeroize-audit. Produces merged-config.yaml, preflight.json, and orchestrator-state.json.

Scan passed 0
1-mcp-resolver

Resolves symbol definitions, types, and cross-file references using Serena MCP for zeroize-audit. Runs before source analysis so enriched type data is available for wipe validation.

Scan passed 0
2-source-analyzer

Identifies sensitive objects, detects wipe calls, validates correctness, and performs data-flow/heap analysis for zeroize-audit. Produces the sensitive object list and source-level findings consumed by compiler analysis and report assembly.

Scan passed 0
2b-rust-source-analyzer

Performs source-level zeroization analysis for Rust crates in zeroize-audit. Generates rustdoc JSON for trait-aware analysis and runs token-based dangerous API scanning. Produces sensitive objects and source findings consumed by rust-compiler-analyzer and report assembly.

Scan passed 0
3-tu-compiler-analyzer

Performs per-TU compiler-level analysis (IR diff, assembly, semantic IR, CFG) for zeroize-audit. One instance runs per translation unit, enabling parallel execution across TUs.

Scan passed 0
3b-rust-compiler-analyzer

Performs crate-level MIR and LLVM IR analysis for Rust in zeroize-audit. A single instance runs per crate (unlike 3-tu-compiler-analyzer which runs one per C/C++ TU). Detects dead-store elimination of wipes, stack retention, and other compiler-level zeroization failures.

Scan passed 0
4-report-assembler

Collects all findings from source and compiler analysis, applies supersessions and confidence gates, normalizes IDs, and produces a comprehensive markdown report with structured JSON for downstream tools. Supports dual-mode invocation: interim (findings.json only) and final (merge PoC results, produ

Scan passed 0
5-poc-generator

Crafts bespoke proof-of-concept programs demonstrating that zeroize-audit findings are exploitable. Reads source code and finding details to generate tailored PoCs — each PoC is individually written, not templated. Each PoC exits 0 if the secret persists or 1 if wiped. Mandatory for every finding.

Scan passed 0

Related knowledge skillsscan passed