A search tool for the Bilt Rewards travel portal, which lists flights and hotels with both cash prices and Bilt Points prices. It also identifies Home Away From Home hotels and their listed benefits.

Use it to compare Bilt travel options, check hotel benefits, and see the points cost of available flights or stays.

It puts money and points prices side by side without requiring authentication for searches.

bilt — Skill for Claude Code by borski/travel-hacking-toolkit

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add borski/travel-hacking-toolkit --skill bilt

Clone the repo

git clone --depth 1 https://github.com/borski/travel-hacking-toolkit

Made for: Claude Code.

Or install travel-hacker, the plugin that ships this one along with the rest of its 48 skills, 1 agent, 6 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/borski/travel-hacking-toolkit/bilt/github.svg)](https://agentmods.dev/skills/borski/travel-hacking-toolkit/bilt)

Your own site

<a href="https://agentmods.dev/skills/borski/travel-hacking-toolkit/bilt"><img src="https://agentmods.dev/badge/skills/borski/travel-hacking-toolkit/bilt/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/borski/travel-hacking-toolkit/bilt"><img src="https://agentmods.dev/badge/skills/borski/travel-hacking-toolkit/bilt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 44 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 4,281 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 7 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Data Exfiltration · line 71
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 81
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 100
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 165
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 198
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 224
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Data Exfiltration · line 232
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00044	$0.04281
Opus 5.5	$0.00018	$0.01712
Sonnet 5.5	$0.00009	$0.00856
Haiku 4.5	$0.00004	$0.00428

Measured 1mo ago against content hash bf7e948e6f8f, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

bilt scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

allowed-tools: Bash(curl *), Bash(jq *)

plugins/travel-hacking-toolkit/skills/bilt/SKILL.md · 375 lines

How it starts

The opening of the file, as written. The whole thing — 375 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bilt Travel Portal Search

Search Bilt Rewards travel portal via the public REST API. No authentication required for search. Returns both cash prices in USD and Bilt Points cost for hotels and flights.

Important: Bilt is Whitelabel Duffel

Bilt's travel search is built directly on top of Duffel. All evidence points to a complete white-label arrangement, not a partial integration:

Flight offer IDs are off_XXX, slices sli_XXX, segments seg_XXX, aircraft arc_XXX, airlines arl_XXX. All Duffel ID patterns.
Carrier and aircraft logos served from assets.duffel.com.
Hotel loyalty program logos served from assets.duffel.com/img/stays/loyalty-programmes. So hotels are Duffel Stays.
JWT organisation_id: org_0000AaALZyFQ... is a Duffel auth pattern.
Field names match Duffel exactly: marketingCarrier, operatingCarrier, cabinClassMarketingName, fareBasisCode, isNDC, ndcRedirectUrl, totalEmissionsKg, slices[].segments[].passengers[].baggages[].

What Bilt adds on top of Duffel:

totalPointsRequired (Bilt Points cost at the fixed 1.25 cpp portal rate)
isHafh (Home Away From Home flag on hotels)
loyaltyProgram.reference (brand affiliation surfacing for hotels)
A few Bilt-specific filter fields

What this means for the toolkit:

For cash-only flight searches, prefer the duffel skill. It uses an authenticated Duffel API key, returns the same data faster, and supports more parameters (multi-city, time windows, max connections, supplier_timeout tuning).
For Bilt Points context (CPP, comparing portal cost to award alternatives, Bilt redemption math), use this skill. The points pricing is exclusive to Bilt's endpoint.
For Home Away From Home property research, use this skill. The isHafh flag is Bilt-specific and surfaces the $300+ benefits properties.

Why It Matters

1.25 cpp standard redemption rate on Bilt Points (1 USD = 80 points). One of the better fixed portal rates.
Home Away From Home (HaFH) is Bilt's premium hotel program. Gold and Platinum members get $300+ in benefits per stay (daily breakfast for two, $100 property credit, room upgrades on arrival, early check-in / late check-out, dedicated Virtuoso Travel Advisor).
Bilt Points transfer 1:1 to Hyatt, Marriott, Hilton, IHG, United, AA, Air Canada Aeroplan, Air France/KLM, Virgin Atlantic, Cathay, Turkish, and more — so this portal is a 1.25 cpp "bottom-of-the-barrel" comparison point for transfer-partner award searches.
Flights are Duffel-backed. Same response shape as the duffel skill. Same airlines, same fare classes, same segment structure.
No auth needed for search. Browser automation, login, 2FA all unnecessary. Just curl.

Read the full file on GitHub · 375 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 375 lines · 44 tokens per session scan A bf7e948e6f8f

Subscribe to this mod's changes

bilt is a skill published in the GitHub repository borski/travel-hacking-toolkit (708 stars, last pushed 2d ago), licensed MIT. It adds 44 tokens to every session and 4,281 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code Finance and fintech award-flights mcp opencode portals skills travel

stock-liquidity

Analyze how liquid a stock is using Yahoo Finance data (yfinance): bid-ask spreads, volume and dollar volume (ADTV), top-of-book and options depth, square-root market impact and slippage estimates, turnover ratio, and Amihud illiquidity, rolled into a liquidity grade. Use this skill whenever the user asks about…

himself65/finance-skills · 129 tokens

alpha-vantage

Access real-time and historical stock market data, forex rates, cryptocurrency prices, commodities, economic indicators, and 50+ technical indicators via the Alpha Vantage API. Use when fetching stock prices (OHLCV), company fundamentals (income statement, balance sheet, cash flow), earnings, options data, market…

foryourhealth111-pixel/Vibe-Skills · 126 tokens

earnings-preview

Build a pre-earnings briefing for a stock from Yahoo Finance data (yfinance): the upcoming report date and timing, consensus EPS and revenue estimates with their range, the beat/miss track record, analyst ratings and price targets, and what to watch in the print. Use this skill whenever the user is preparing for an…

himself65/finance-skills · 135 tokens

earnings-recap

Analyze a company's most recent (or a specified past) earnings report from Yahoo Finance data (yfinance): actual vs estimated EPS, surprise size, revenue and margin trends, and the stock's price reaction. Use this skill whenever the user asks how earnings went — beat or miss, earnings surprise, quarterly results, the…

himself65/finance-skills · 112 tokens

estimate-analysis

Analyze sell-side analyst estimates and how they are changing, using Yahoo Finance data (yfinance): EPS and revenue consensus by period, estimate ranges and dispersion, revision trends over 7/30/60/90 days and up/down revision breadth, growth estimates vs industry, sector, and the S&P 500, and historical estimate…

himself65/finance-skills · 117 tokens

finance-sentiment

Fetch normalized stock sentiment across Reddit, X.com, financial news, and Polymarket from the Adanos Finance API: buzz score, bullish percentage, mention or trade counts, and trend. Use this skill whenever the user asks how much a stock is being discussed or how hot it is on social platforms, how many Reddit mentions…

himself65/finance-skills · 111 tokens

bilt