Trail of Bits Ships Tarot-Powered Claude Skill: let-fate-decide

Level 1: Asking the Magic Cards

When a kid can't decide between chocolate and vanilla, sometimes they flip a coin — not because the coin is wise, but because any answer beats standing frozen at the counter. This is a famous, very serious computer-security company building a fancy coin flip for their robot assistant: when a request is too fuzzy to answer, the robot draws fortune-telling cards and goes with what they say. The laugh is the mismatch — the world's most careful engineers, solving indecision with a deck of magic cards, and doing it with absolutely perfect craftsmanship.

Level 2: The Pieces on the Table

• Claude Code skill: a packaged extension for Anthropic's terminal coding agent — instructions plus scripts the model can invoke. Here the script shuffles cards; the model interprets them.
• os.urandom(): Python's tap into the OS's high-quality randomness, the kind used for keys and tokens — deliberate overkill for a card game, and that's the point.
• Fisher-Yates shuffle: the textbook fair-shuffle algorithm: walk the deck once, swapping each card with a randomly chosen remaining card. Fair, fast, and the first thing you get wrong in an interview.
• Fuzzing: throwing semi-random inputs at software to find bugs — Trail of Bits' specialty, which makes "tarot for planning" an on-brand self-parody.
• Balatro: a hit poker-roguelike about chasing absurd card synergies; "playing balatro with my fuzzer" means treating randomized tooling like a game you're addicted to.

If you're early-career, the relatable kernel is the vague ticket. "Make the dashboard better" has no correct decomposition, and the panic of choosing arbitrarily is universal. Seniors just hide the coin flip behind a confident architecture document.

Level 3: Divination-Driven Development

The screenshot layers three jokes. Dan Guido — CEO of Trail of Bits, a firm whose name on an audit report moves real money — announces let-fate-decide, a Claude Code skill whose rendered README deadpans:

A Claude Code skill that draws Tarot cards using os.urandom() to inject entropy into vague or underspecified planning decisions.

Then @samlakig quote-tweets it as "playing balatro with my llm guided fuzzer," reframing agentic engineering as a card-based roguelike where you keep rerolling hands until the build comes together. Anyone who has watched an LLM agent retry a flaky plan knows that comparison is uncomfortably load-bearing.

The satire's real target is underspecified requirements. The Triggers list is an taxonomy of every way humans abdicate decisions to machines: "whatever you think", "surprise me", "dealer's choice", and — the most surgically observed line in the image — "Try again" on a system with no actual changes (redraw). That last trigger names the dirtiest secret of LLM-era workflows: re-running an identical prompt and hoping for a different result is already divination. Sampling temperature is a deck; you were always drawing cards. The skill doesn't introduce superstition into the process — it makes the existing superstition explicit, auditable, and cryptographically sound, which is the most security-firm move imaginable. It also lands as commentary on planning culture broadly: when stakeholders refuse to specify, something breaks the tie — the loudest voice, the most recent blog post, the HiPPO. At least the Major Arcana is documented and has a meaning file.

Level 4: Entropy, Properly Sourced

The README's funniest line is also its most technically defensible: the deck is shuffled with os.urandom() driving a Fisher-Yates shuffle. That pairing is a tiny cryptography lecture disguised as a gag. os.urandom() reads from the operating system's CSPRNG (cryptographically secure pseudorandom number generator) — on Linux, the kernel's ChaCha20-based pool fed by hardware interrupt timing and similar physical entropy sources — meaning the draw is unpredictable even to an adversary who knows the code. Contrast Python's default random module, a Mersenne Twister whose entire future output can be reconstructed from 624 consecutive 32-bit outputs. If your fate must be decided, it should at least be unforgeable fate.

Fisher-Yates matters for the same pedantic-correct reason: it is the only standard shuffle that produces a uniform distribution over all $78!$ permutations (~$10^{115}$, comfortably more states than any seed-based PRNG could even index — another reason to use a true entropy source). The naive alternative, sort(key=lambda _: random()), is provably biased. And the "independent 50% reversal" per card multiplies the space by $2^4$. A security firm writing a joke tool and still refusing to ship modulo bias is the joke: rigor as compulsion. There's also a quietly real idea underneath — fuzzing, Trail of Bits' actual day job, is the discipline of using randomness to explore decision spaces humans are too biased to search. Tarot-as-tiebreaker is fuzzing applied to product planning, which is why the quote tweet ("llm guided fuzzer") closes the loop so neatly.