前端审计
- 作者仓库星标 5,723
- 叉子 499
- 作者更新于 2026年6月15日 16:05
- 作者仓库 skills
- 领域
- 通用
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @trailofbits · 未声明 license
- Token 消耗评级
- 低消耗
- 接入复杂程度
- 需简单配置
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- 未声明(默认跨平台)
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- Shell 执行
- 网络行为
- 仅限本地
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: let-fate-decide
description: Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are…
category: 通用
runtime: 无特殊运行时
---
# let-fate-decide 输出预览
## PART A: 任务判断
- 适用问题:通用任务拆解、检查和交付。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Quick Start / When to Use / When NOT to Use”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于通用任务拆解、检查和交付,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Quick Start / When to Use / When NOT to Use”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、执行终端命令、主要在本地完成、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件、执行终端命令;主要在本地完成;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文没有稳定的斜杠命令要求。安装验证后通常全局生效,直接在对话里点名这个 Skill 并描述任务即可。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件、执行终端命令。
先用一个小任务确认它会围绕“Quick Start / When to Use / When NOT to Use”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: let-fate-decide
description: Draws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are…
category: 通用
source: trailofbits/skills
---
# let-fate-decide
## 什么时候使用
- let-fate-decide 是一个通用扩展技能,按 SKILL 适合处理通用任务拆解、检查、交付和复盘,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤…
- 面向通用任务拆解、检查和交付,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Quick Start / When to Use / When NOT to Use」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令;主要在本地完成;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "let-fate-decide" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Quick Start / When to Use / When NOT to Use
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、写入/修改文件、执行终端命令 | 主要在本地完成
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} Let Fate Decide
When the path forward is unclear, let the cards speak.
Quick Start
Run the drawing script:
uv run --no-config {baseDir}/scripts/draw_cards.pyThe script outputs JSON for the default 12 Houses of the Zodiac spread: 12 houses, each with 1 Major Arcana card and 2 Minor Arcana cards. Each house and card includes a
filepath relative to{baseDir}/Read each house file and each card's meaning file to understand the draw. For faster reads, use
--contentto include house and card text directly in the JSON:uv run --no-config {baseDir}/scripts/draw_cards.py --contentInterpret the spread using the guide at {baseDir}/references/INTERPRETATION_GUIDE.md
When the task belongs to a specialized technical workflow, use {baseDir}/references/TECHNICAL_CONTEXT_LENSES.md to translate the reading into an audit, verification, domain, failure-class, or stakeholder lens
Apply the interpretation to the task at hand
When to Use
- Vague prompts: The user's request is ambiguous and multiple reasonable approaches exist
- Explicit invocations: "I'm feeling lucky", "let fate decide", "dealer's choice", "surprise me", "whatever you think", "YOLO"
- Casual delegation: "whatever", "up to you", "your call", "idk", "just do something", "wing it", "I trust you", "doesn't matter", "do what you want", "I don't care", "any approach works", "you pick"
- Yu-Gi-Oh energy: "Heart of the cards", "I believe in the heart of the cards", "you've activated my trap card", "it's time to duel"
- Shrug-like brevity: Very short prompts that fully delegate the decision without expressing a preference
- Redraw requests: "Try again" or "draw again" when no actual system changes occurred (this means draw new cards, not re-run the same approach)
- Tie-breaking: When you are about to arbitrarily pick between 2+ valid approaches, draw cards instead of silently choosing one
When NOT to Use
- The user has given clear, specific instructions
- The task has a single obvious correct approach
- As the deciding authority for safety-critical work (security, data integrity, production deployments, release approval, incident response)
- The user explicitly asks you NOT to use Tarot
- The user's tone is precision-seeking rather than casual -- use
ask-questions-if-underspecifiedinstead to gather actual requirements
Security and Correctness Use
This skill may be used inside a security, audit, or correctness pipeline as a creative lens for discovery: choosing which angle to inspect next, breaking analysis paralysis, generating hypotheses, or surfacing blind spots.
It is never sufficient by itself. In security and correctness contexts, the reading must be followed by ordinary engineering evidence: source review, tests, proofs, traces, reproduction steps, exploitability analysis, or other domain-appropriate verification. Do not treat a favorable card as permission to ship, suppress a finding, skip validation, or overrule a concrete risk.
How It Works
The Draw
The script uses secrets for cryptographic randomness:
- Builds separate Major Arcana (22 cards) and Minor Arcana (56 cards) decks
- Performs Fisher-Yates shuffles via
secrets.randbelow()(no modulo bias) - Deals the default 12 Houses of the Zodiac spread
- Each house receives 1 Major Arcana card followed by 2 Minor Arcana cards
- Each of the 36 cards independently has a 50% chance of being reversed
The default spread records a conservative unordered-card entropy budget
exceeding 100 bits: roughly log2(C(22,12)) bits from Major Arcana selection,
log2(C(56,24)) bits from Minor Arcana selection (assuming
secrets.randbelow() is cryptographically secure), plus 36 reversal bits. The
exact values are computed and reported in the JSON output under entropy_bits.
The actual ordered assignment of cards to houses contains more entropy.
The Spread
The default spread is 12 Houses of the Zodiac:
| House | Represents | Question It Answers |
|---|---|---|
| 1 | Self | How should this work begin? |
| 2 | Resources | What values, assets, or constraints matter? |
| 3 | Communication | What needs to be clarified or connected? |
| 4 | Foundations | What context or dependency anchors the task? |
| 5 | Creativity | Where should experimentation or delight shape the work? |
| 6 | Practice | What quality, maintenance, or execution concern matters? |
| 7 | Partnership | Who or what must this integrate with? |
| 8 | Transformation | What risk, shared state, or deep change is present? |
| 9 | Exploration | What principle or broader strategy guides the path? |
| 10 | Calling | What delivery or long-term outcome is being served? |
| 11 | Community | What system, network, or shared aspiration is involved? |
| 12 | The Hidden | What blind spot, ending, or unconscious factor matters? |
Within each house, the Major Arcana card sets the archetypal theme and the two Minor Arcana cards provide practical detail.
For compatibility with older workflows, draw_cards.py --legacy returns the
previous 4-card hand, and draw_cards.py --legacy <count> returns a custom
hand of 1-78 cards. A positional count without --legacy is rejected, because
the new default spread has a fixed shape.
Reference Files
Each house's meaning is in its own markdown file under {baseDir}/houses/.
House files describe how the house applies across technical contexts including
building new projects, vulnerability discovery, correctness verification, and
common audit, verification, domain, failure-class, and stakeholder workflows.
Each card's meaning is in its own markdown file under {baseDir}/cards/:
cards/major/- 22 Major Arcana (archetypal forces)cards/wands/- 14 Wands (creativity, action, will)cards/cups/- 14 Cups (emotion, intuition, relationships)cards/swords/- 14 Swords (intellect, conflict, truth)cards/pentacles/- 14 Pentacles (material, practical, craft)
Interpretation
After drawing, read each house file and each card file, then synthesize meaning. See {baseDir}/references/INTERPRETATION_GUIDE.md for the full interpretation workflow. For cross-domain translation, see {baseDir}/references/TECHNICAL_CONTEXT_LENSES.md.
Key rules:
- Reversed cards invert or complicate the upright meaning
- Major Arcana cards carry more weight than Minor Arcana
- The spread tells a story across all 12 houses; don't interpret cards in isolation
- Map abstract meanings to concrete technical decisions
- In security, audit, and correctness work, use the reading to choose an investigation path, then require evidence before accepting or dismissing any risk
- Never output interpretation as a text-only turn. Include the
interpretation alongside your next tool call (the action that
implements the chosen option). Prefer
--contentso all 36 card meanings and all 12 house meanings are available from the draw output.
Example Session (House-Level Fragment)
A real reading synthesizes all 12 houses; the fragment below shows only what one house contributes so the format is clear. Do not stop after one house in actual use.
User: "I dunno, just make it work somehow"
[Draw cards]
1st House (Self): The Magician (upright), Five of Swords (reversed),
Ten of Pentacles (upright)
House contribution: The starting stance is resourceful and tool-rich
(Magician), but the practical details warn against combative edge-case work
(Five of Swords reversed) while still favoring maintainable craft
(Ten of Pentacles). This is one input into the overall reading; combine with
the remaining 11 houses before deciding on an approach.
The named draw agent returns a more compact form for portent questions:
3 concise bullets covering the dominant theme, the main risk or blind spot,
and the recommended next action.
Error Handling
If the drawing script fails:
- Script crashes with traceback: Report the error to the user and skip the reading. Do not invent cards or simulate a draw — the whole point is real entropy.
- Card file not found: Note the missing file, interpret the card from its name and suit alone, and continue with the reading.
- Never fake entropy: If the script cannot run, do not simulate a draw using your own "randomness." Tell the user the draw failed.
Rationalizations to Reject
| Rationalization | Why Wrong |
|---|---|
| "The cards said to, so I must" | Cards inform direction, they don't override safety or correctness |
| "This reading justifies my pre-existing preference" | Be honest if the reading challenges your instinct |
| "The reversed card means do nothing" | Reversed means a different angle, not inaction |
| "Major Arcana overrides user requirements" | User requirements always take priority over card readings |
| "I'll keep drawing until I get what I want" | One draw per decision point; accept the reading |
| "The reading says the risk is fine" | Cards can suggest what to inspect; only evidence can dismiss a security or correctness concern |
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核