Borrowing it
Nothing to install: this file belongs to dbhq-uk/trello-skill. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/dbhq-uk/trello-skill/main/AGENTS.mdgit clone --depth 1 https://github.com/dbhq-uk/trello-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/dbhq-uk/trello-skill/agents-md)<a href="https://agentmods.dev/instructions/dbhq-uk/trello-skill/agents-md"><img src="https://agentmods.dev/badge/instructions/dbhq-uk/trello-skill/agents-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/dbhq-uk/trello-skill/agents-md"><img src="https://agentmods.dev/badge/instructions/dbhq-uk/trello-skill/agents-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02058 | $0.02058 |
| Opus 5.5 | $0.00823 | $0.00823 |
| Sonnet 5.5 | $0.00412 | $0.00412 |
| Haiku 4.5 | $0.00206 | $0.00206 |
Grade A, and why
trello-skill AGENTS.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Any caller-supplied text sent to the API (card names, descriptions, comments) goes through `curl --data-urlencode`, never plain `-d` - `-d` sends the body raw, so an `&` silently truncates the value and a `+` arrives a How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
Guidance for AI agents (and people) working in this repository.
What this is
The Trello skill pack for AI coding agents - a set of skills for working with Trello via the REST API. It follows the Agent Skills layout (skills/<name>/SKILL.md) and ships as a Claude Code plugin.
Layout
.claude-plugin/plugin.json # plugin manifest (bundles all skills below)
skills/trello/ # core board/list/card management + setup
skills/store-sort/ # shopping list into store-aisle order (Tesco preset, as data)
skills/board-digest/ # board status snapshot
skills/due-radar/ # due/overdue across boards
skills/life-manager/ # personal board setup, triage and coaching
install.sh / install-codex.sh # local symlink installers (Claude / Codex)
Each skill is skills/<name>/SKILL.md plus optional scripts/ and references/.
Conventions
- Every script sources
skills/trello/scripts/lib.sh, found relative to its own path, and makes no request of its own. lib.sh holds config loading, the~/.trellomigration, the oneapi()call, paging (api_get_all), local-time rendering (trello_jq_defs,local_now) and the shared helpers, so a fix to how a request is made lands once. Scripts in the other skills reach it as../../trello/scripts/lib.shand, when a partial install lefttrelloout, stop with a message that names it. - The
trellocore skill owns setup, lib.sh and the shared API scripts. Other skills (e.g.store-sort) call the core scripts by their${CLAUDE_SKILL_DIR}/../trello/scripts/...path -${CLAUDE_SKILL_DIR}is the calling skill's own directory, so../trellois the sibling core skill (all skills sit side by side under the plugin /~/.claude/skills/). - That holds for the plugin and
install.sh, not for a partial install: the skills CLI lets a user pick single skills. So the README install section and each of the four other SKILL.md files saytrellomust be installed beside them and give thenpx skills add ... --skill trello --skill <name>command, and every script call in a SKILL.md code block starts at${CLAUDE_SKILL_DIR}, never a bare script name. The suite checks both. - SKILL.md references scripts via
${CLAUDE_SKILL_DIR}(the skill's own directory), which Claude Code substitutes for personal, project, and plugin installs alike.install.shtherefore symlinks the whole skill directory into~/.claude/skills/(no rewrite).install-codex.shstill rewrites the variable to the install path, since Codex does not substitute it. - Shell scripts use
set -e; errors go to stderr, structured output to stdout.api()in lib.sh retries an HTTP 429 three times (waiting 2, 4 and 8 seconds), then stops the script on any non-2xx answer with Trello's status and message, because Trello sends its errors as plain text, not JSON. So a verb handles success only, and prints "nothing found" only for a real empty result. - A request for a long list - a board's cards, its actions, a card's comments, a list's cards - goes through
api_get_all, neverapi_get. Trello answers at most 1000 results a request and says nothing when it stops;api_get_allpages withbeforeuntil a page comes back short, and says "capped at N" on stderr if it has to stop first. - Every time a script shows goes through
local_timeorlocal_datefromtrello_jq_defs, never.due[0:10]: Trello stores UTC, and its first ten characters are the UTC date, which is the wrong day near midnight for anyone not on UTC. The zone is named once per output, fromlocal_now, because jq's%Znames it wrongly. - Whether a list is a done list is
is_done_listintrello_jq_defs, and nowhere else. A card in one with its due date not ticked is finished work: due-radar and board-digest name its list and never call it OVERDUE. - Every change a SKILL.md asks for has a verb in a script. When a skill needs a new write - life-manager's board, list and label setup, or ticking a checklist item - add the verb to
trello-boards.shortrello-cards.shand document it in trello/SKILL.md. A SKILL.md never has the agent build a request of its own, because that puts the key and token on the agent's command line. - A script that writes many cards writes only the ones that must change, checks every write, and stops at the first one Trello refuses, naming the card and saying the rest was not done.
life-board.sh sort --applyis the model: a sorted list gets no write, because every write moves a card'sdateLastActivityand fills the board's activity. - Any caller-supplied text sent to the API (card names, descriptions, comments) goes through
curl --data-urlencode, never plain-d--dsends the body raw, so an&silently truncates the value and a+arrives as a space. - No secrets in the repo - credentials live under
~/.dbhq/trello/. trello-setup.shstays interactive. The user types the key and token; with no terminal on stdin it changes nothing, prints the command for the user and exits 3. The token is read withread -rs, and config.json is written byjqfrom stdin, so a"or\stays valid JSON and no credential is ever a process argument. The suite drives it through a real pseudo-terminal to prove all of this.- Trigger phrases in a SKILL.md description name Trello, a board or the skill. An agent picks a skill by those phrases, so a bare "I'm stuck", "what's due" or "shopping list" takes requests that belong to a calendar, a decision skill or store-sort. Each skill does its own job once:
trellohas no sorting workflow and hands a shopping list to store-sort. The suite checks the phrases. - House style: British English, plain hyphens.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +16 lines · +1,075 tokens per session df888fe48f21
- 1mo ago Changed · +20 lines · +313 tokens per session a1ac91eb3d66
- 1mo ago Changed · +6 tokens per session 6c390c5b2481
- 1mo ago First seen · 44 lines · 664 tokens per session scan A 4c669b163d39
trello-skill AGENTS.md is an instructions file published in the GitHub repository dbhq-uk/trello-skill (2 stars, last pushed 21d ago), licensed MIT. It adds 2,058 tokens to every session, about $0.0082 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
deno copilot-instructions.md
Copilot instructions for denoland/deno, covering deno development guide for github copilot, network access, high level overview, key directories and key files to understand first.