Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/borski/travel-hacking-toolkit/lessons-learnednpx skills add borski/travel-hacking-toolkit --skill lessons-learnedgit clone --depth 1 https://github.com/borski/travel-hacking-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/borski/travel-hacking-toolkit/lessons-learned)<a href="https://agentmods.dev/skills/borski/travel-hacking-toolkit/lessons-learned"><img src="https://agentmods.dev/badge/skills/borski/travel-hacking-toolkit/lessons-learned.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01957 |
| Opus 5 | $0.00023 | $0.00979 |
| Sonnet 5 | $0.00009 | $0.00391 |
| Haiku 4.5 | $0.00005 | $0.00196 |
Grade A, and why
lessons-learned scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 106 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Lessons Learned
Hard-won knowledge from actual searches. Reference these before making the same mistakes.
Seats.aero: Search ALL Sources, Show ALL Results
When searching Seats.aero, NEVER filter by source on the initial search. Always pull ALL programs first.
The Mandatory Workflow
For any route:
- Search Seats.aero with NO source filter. Pull ALL programs. Show full results sorted by cheapest.
- For EVERY program in results, trace the full reachability chain:
a. Direct balance? (Check AwardWallet if connected)
b. Transfer path? (Check
data/transfer-partners.jsonfor EVERY currency: Amex MR, Chase UR, Bilt, Capital One) c. Alliance chain? Identify the operating airline's alliance (data/alliances.json), then find ALL programs in that alliance or with bilateral partnerships (data/partner-awards.json), then check which of THOSE programs are reachable via transfer. d. Cross-alliance? Checkdata/partner-awards.jsoncross_alliance_highlightsand bilateral partners. - For reachable programs with NO cached Seats.aero data, check the program's website directly (airfrance.com, united.com, etc.)
- Present the COMPLETE picture: every option, reachable or not, with the transfer chain spelled out.
- Only THEN compare award vs cash.
Common Failure Mode
Seeing an airline in results, checking one or two obvious programs, declaring awards "unreachable" or "bad value," and recommending cash. You MUST trace every possible chain through alliances and bilateral partnerships. If the operating airline is in an alliance, EVERY program that books that alliance is a potential path.
"No Cached Availability" Is Not the Final Word
It means Seats.aero hasn't scraped it recently. When a reachable program shows no cached results, search the airline's website directly before declaring awards dead.
Never Trust Data Files Over Reality
Data files are reference material, not gospel. Airline partnerships change constantly. When a user says a booking path works that your data doesn't show, verify on the actual booking website FIRST before pushing back. The website is the source of truth. Your files are a cache. If the data file disagrees with reality, update the data file.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 106 lines · 45 tokens per session scan A 250634657d0a
lessons-learned is a skill published in the GitHub repository borski/travel-hacking-toolkit (650 stars, last pushed 5d ago), licensed MIT. It adds 45 tokens to every session and 1,957 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
reddit-search-api
Pure API reference for reddapi.dev - authentication, all endpoints (vector search, semantic search, trends, subreddit lookup), request parameters, response schemas, and error codes, with no research-workflow framing. Use when the user wants raw endpoint documentation, is debugging a reddapi.dev integration, needs…
docs-builder
Reorg a docs corpus, split an oversized doc, search it, keep pages current, index them.
remember
Consolidate stashes + friction into project memory.
branch-review
Review a branch before merge [target] [level].
root-cause
Use when any test fails, bug appears, or behaviour surprises you, before proposing a fix - find the cause and prove it, by reading real evidence, tracing bad values back to their origin, comparing against a working case, and testing one hypothesis at a time.
ship
Mechanical pre-deploy gate — tests, build, tree state.