Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add borski/travel-hacking-toolkit --skill tripadvisorgit clone --depth 1 https://github.com/borski/travel-hacking-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/borski/travel-hacking-toolkit/tripadvisor)<a href="https://agentmods.dev/skills/borski/travel-hacking-toolkit/tripadvisor"><img src="https://agentmods.dev/badge/skills/borski/travel-hacking-toolkit/tripadvisor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.03207 |
| Opus 5 | $0.00018 | $0.01604 |
| Sonnet 5 | $0.00007 | $0.00641 |
| Haiku 4.5 | $0.00004 | $0.00321 |
Grade C, and why
tripadvisor scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "https://api.content.tripadvisor.com/api/v1/location/search?key=$TRIPADVISOR_API_KEY&searchQuery=Amerikalinjen+Oslo&category=hotels" | python3 -m json.tool Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Monthly quota:** 5,000 API calls per month. Each curl request = 1 call. A full hotel lookup (search + details + reviews + photos) = 4 calls. Budget accordingly. Prefer search + details (2 calls) and only fetch reviews/ How it starts
The opening of the file, as written. The whole thing — 306 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TripAdvisor Content API
Search and retrieve hotel, restaurant, and attraction data from TripAdvisor. Ratings, rankings, reviews, photos, amenities, subratings, trip types, awards.
Base URL: https://api.content.tripadvisor.com/api/v1
Rate limit: 50 calls per second.
Monthly quota: 5,000 API calls per month. Each curl request = 1 call. A full hotel lookup (search + details + reviews + photos) = 4 calls. Budget accordingly. Prefer search + details (2 calls) and only fetch reviews/photos when specifically needed.
API limits: Up to 10 results per search. Up to 5 reviews and 5 photos per location.
Authentication
First-time setup gotcha: TripAdvisor requires whitelisting your outbound IP at https://www.tripadvisor.com/developers before the key works. Without this, every call returns
User is not authorized to access this resource with an explicit deny. This is the #1 first-time failure mode. Whitelist before troubleshooting auth or quotas.
- How to find your current IP:
curl ifconfig.me- Propagation: changes take 1-5 minutes (AWS edge cache).
- Multi-IP: residential CGNAT, VPN exits, and different networks each need their own entry.
- No Referer alternative: the free tier requires IP whitelisting; HTTP Referer restriction is not available.
- Verify which key is which: the developer portal shows the last 4 chars only (e.g. "Ends in 11D7"), so you can confirm without exposing the secret.
Set TRIPADVISOR_API_KEY in your .env file:
# In .env (gitignored)
TRIPADVISOR_API_KEY=your_key_here
Then source it before calling:
export $(grep TRIPADVISOR_API_KEY .env | xargs)
Error signatures
| Response | Meaning | Fix |
|---|---|---|
User is not authorized to access this resource with an explicit deny |
IP not on allowlist | Whitelist current IP at the developer portal, wait 1-5 min |
Forbidden / 403 with no body |
Bad or expired key | Regenerate key |
429 Too Many Requests |
Hit monthly quota (5,000 calls) | Wait until next month or upgrade tier |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 306 lines · 37 tokens per session scan C 56de224135f1
tripadvisor is a skill published in the GitHub repository borski/travel-hacking-toolkit (652 stars, last pushed 6d ago), licensed MIT. It adds 37 tokens to every session and 3,207 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
docs-builder
Reorg a docs corpus, split an oversized doc, search it, keep pages current, index them.
remember
Consolidate stashes + friction into project memory.
live-canvas
Conduct design interviews, generate UI variations, and collect live click-to-annotate feedback that streams into the session so edits land without leaving the browser. Use when the user wants rapid iterative UI refinement, not just batched feedback.
branch-review
Review a branch before merge [target] [level].
root-cause
Use when any test fails, bug appears, or behaviour surprises you, before proposing a fix - find the cause and prove it, by reading real evidence, tracing bad values back to their origin, comparing against a working case, and testing one hypothesis at a time.
ship
Mechanical pre-deploy gate — tests, build, tree state.