Lixin2026
d5fe2e6a78
* feat(codex): add skill UI metadata * Use official Trail of Bits logo * fix: resolve code review findings for PR #175 Codex silently drops the icons as authored: its loader (codex-rs/core-skills resolve_asset_path) requires icon paths containing '..' to resolve under <plugin_root>/assets/, and the repo-root .codex/assets location fails that containment check. Verified empirically via codex app-server plugin/read: every iconSmall/iconLarge came back null; only brand_color applied. P1 fixed: - Vendor trail-of-bits-mark.svg into plugins/<name>/assets/ for all 38 plugins with skills and point every openai.yaml at ../../assets/trail-of-bits-mark.svg (the supported plugin-level shared asset pattern). Icons now resolve for marketplace installs too, since nothing escapes the plugin root. - Drop the .codex/ additions: .codex/skills/gh-cli/agents/ openai.yaml resolved nowhere (.codex/skills is not a Codex discovery root) and PR #173 removes the whole .codex/ tree P2 fixed: - Patch-bump all 38 touched plugins in plugin.json and marketplace.json so installed clients pick up the metadata Verified: - Static check replicating Codex's resolution algorithm: all 73 yaml files resolve under their plugin assets/ and exist - Live codex app-server probe: 71/72 loadable skills report resolved iconSmall/iconLarge and brand_color #D83A34 (claude-in-chrome-troubleshooting fails to load on main due to a pre-existing 64-char qualified-name limit, fixed by #173's rename; zeroize-audit's manifest mcpServers object is likewise a pre-existing Codex incompatibility fixed by #173) - validate_codex_skills.py, validate_plugin_metadata.py, prek all pass Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(codex): use skill-local icon assets --------- Co-authored-by: Dan Guido <dan@trailofbits.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
let-fate-decide
A Claude Code skill that draws Tarot cards using secrets to inject
entropy into vague or underspecified planning decisions.
What It Does
When a prompt is sufficiently ambiguous, or the user explicitly invokes fate, this skill shuffles a 22-card Major Arcana deck and a 56-card Minor Arcana deck independently using cryptographic randomness, then deals the 12 Houses of the Zodiac spread. Each house receives one Major Arcana card followed by two Minor Arcana cards, and all 36 cards may appear reversed. Claude then interprets the spread and uses the reading to inform its approach.
Triggers
- Vague or ambiguous prompts where multiple reasonable approaches exist
- "I'm feeling lucky", "let fate decide", "dealer's choice", "surprise me", "whatever you think", "YOLO"
- Casual delegation ("whatever", "up to you", "your call", "idk", "just do something", "wing it", "I trust you", "doesn't matter", "do what you want", "I don't care", "any approach works", "you pick")
- Yu-Gi-Oh references ("heart of the cards", "I believe in the heart of the cards", "you've activated my trap card", "it's time to duel")
- Shrug-like brevity -- very short prompts that fully delegate the decision
- About to arbitrarily pick between 2+ valid approaches (draw cards instead)
- "Try again" on a system with no actual changes (redraw)
How It Works
- A Python script uses
secrets.randbelow()to perform Fisher-Yates shuffles - A Major Arcana deck and Minor Arcana deck are shuffled separately
- 12 houses are dealt, each with 1 Major Arcana and 2 Minor Arcana cards
- Each card has an independent 50% chance of being reversed
- Claude reads the house reference files and drawn cards' meaning files
- Claude interprets the spread
- The interpretation informs the planning direction
The default spread records a conservative unordered-card entropy budget
exceeding 100 bits: roughly log2(C(22,12)) bits from Major Arcana selection,
log2(C(56,24)) bits from Minor Arcana selection (assuming
secrets.randbelow() is cryptographically secure), and 36 bits from
independent card reversal choices. Exact values are computed at draw time and
reported in the JSON output under entropy_bits. The actual ordered assignment
of cards to houses contains more entropy.
In security, audit, and correctness workflows, this skill is only a discovery and hypothesis-generation aid. It can suggest where to look next, but evidence from review, testing, reproduction, or formal reasoning must decide whether a risk is real or resolved.
Reference Organization
Each zodiac house has its own markdown file under houses/. These files
explain the house's technical meaning for building new projects, vulnerability
discovery, correctness verification, and recurring workflows from the local
security and engineering workflows this skill supports.
references/TECHNICAL_CONTEXT_LENSES.md distills those workflow themes into
audit-stage, evidence-mode, domain, failure-class, and human/organizational
lenses.
Each of the 78 Tarot cards has its own markdown file:
cards/major/- 22 Major Arcana (The Fool through The World)cards/wands/- 14 Wands (Ace through King)cards/cups/- 14 Cups (Ace through King)cards/swords/- 14 Swords (Ace through King)cards/pentacles/- 14 Pentacles (Ace through King)