Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/triggerdotdev/trigger.dev/errors-api-e2enpx skills add triggerdotdev/trigger.dev --skill errors-api-e2egit clone --depth 1 https://github.com/triggerdotdev/trigger.devWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00129 | $0.04210 |
| Opus 5 | $0.00064 | $0.02105 |
| Sonnet 5 | $0.00026 | $0.00842 |
| Haiku 4.5 | $0.00013 | $0.00421 |
Grade D, and why
errors-api-e2e scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
printf '%s' "$ROWS" | curl -s "$CHURL/?query=$Q" --data-binary @- Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s "$B/api/v1/errors?filter%5BtaskIdentifier%5D=$TASK&filter%5Bstatus%5D=unresolved&filter%5Bperiod%5D=1d" -H "$H" | python3 -c "import sys,json;print('unresolved:',len(json.load(sys.stdin)['data']))" # 2 Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Webapp running on http://localhost:3030 (`pnpm run dev --filter webapp`). Confirm `curl -s http://localhost:3030/healthcheck`. How it starts
The opening of the file, as written. The whole thing — 200 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Errors API — end-to-end smoke test
Proves the public Errors API against the running webapp with real HTTP. No
mocks. The error data plane is ClickHouse (errors_v1 + error_occurrences_v1,
both materialized-view-fed from task_runs_v2) plus Postgres ErrorGroupState
for lifecycle status; this skill seeds straight into task_runs_v2 and lets the
MVs do the rest.
Code under test:
apps/webapp/app/routes/api.v1.errors.ts—GET /api/v1/errors(list).apps/webapp/app/routes/api.v1.errors.$errorId.ts—GET /api/v1/errors/:errorId(detail).apps/webapp/app/routes/api.v1.errors.$errorId.{resolve,ignore,unresolve}.ts— state actions.apps/webapp/app/presenters/v3/ApiErrorListPresenter.server.ts/ApiErrorGroupPresenter.server.ts.apps/webapp/app/presenters/v3/ApiRunListPresenter.server.ts— thefilter[error]addition onGET /api/v1/runs.apps/webapp/app/v3/services/errorGroupActions.server.ts— resolve/ignore/unresolve (nullableuserId).- Attribution:
api.v1.projects.$projectRef.$env.jwt.tsstampsact:{sub}for PAT and UAT exchanges;@trigger.dev/rbacsurfacesact.subthrough bearer auth; the action handlers readauthentication.actor?.sub.
errorId is error_<fingerprint> (round-trips via ErrorId in @trigger.dev/core/v3/isomorphic).
Prerequisites
- Webapp running on http://localhost:3030 (
pnpm run dev --filter webapp). Confirmcurl -s http://localhost:3030/healthcheck. - DB seeded (
pnpm run db:seed), and a local ClickHouse reachable atCLICKHOUSE_URL(thepnpm run dockerstack). - The CLI built + logged in to localhost:3030 (
pnpm run build --filter trigger.dev; profiledefaultpoints at localhost:3030). Needed only for the attribution leg.
Important wiring facts the seed relies on (verified):
- The MVs read the error type/message from
error.data.*, so the seedederrorJSON column must be wrapped:{"data": {"type": ..., "message": ..., "stack": ...}}.- The MVs only fire for failed statuses:
SYSTEM_FAILURE | CRASHED | INTERRUPTED | COMPLETED_WITH_ERRORS | TIMED_OUT, and require a non-emptyerror_fingerprint.GET /api/v1/runslists run ids from ClickHouse but hydrates from PostgresTaskRun. So the error-list/detail/action legs work from a ClickHouse-only seed, but thefilter[error]leg needs a paired PostgresTaskRunrow whoseidequals the ClickHouserun_id.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 200 lines · 129 tokens per session scan D 42f9a036137e
errors-api-e2e is a skill published in the GitHub repository triggerdotdev/trigger.dev (16,165 stars, last pushed 2d ago), licensed Apache-2.0. It adds 129 tokens to every session and 4,210 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it D with 3 findings (sends data to an external url, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
workflow
Creates durable, resumable workflows using Vercel's Workflow SDK. Use when building workflows that need to survive restarts, pause for external events, retry on failure, or coordinate multi-step operations over time. Triggers on mentions of "workflow", "durable functions", "resumable", "workflow sdk", "queue"…
migrating-workflow-v4-to-v5
Upgrades an app from Workflow SDK 4.x to 5.0. Use when bumping the workflow / @workflow/ dependencies to v5, or when hitting removed v4 APIs — runStep, stepEntrypoint, workflow/internal/private, @workflow/core/private, writeToStream / closeStream / readFromStream on a World, world.steps.get without a runId…
migrating-world-v4-to-v5
Upgrades a custom Workflow SDK World implementation from the v4 spec to v5. Use when a package implements the World interface from @workflow/world and is moving to 5.x — event IDs that are ULIDs rather than slot positions, Event id is not slot-numbered at replay time, a specVersion the runtime refuses, writeToStream /…
migrating-to-workflow-sdk
Migrates Temporal, Inngest, Trigger.dev, and AWS Step Functions workflows to the Workflow SDK. Use when porting Activities, Workers, Signals, step.run(), step.waitForEvent(), Trigger.dev tasks / wait.forToken / triggerAndWait, ASL JSON state machines, Task/Choice/Wait/Parallel states, task tokens, or child workflows.
workflow-init
Install and configure Vercel Workflow SDK before it exists in nodemodules. Use when the user asks to "install workflow", "set up workflow", "add durable workflows", "configure workflow sdk", or "init workflow" for Next.js, Express, Hono, Fastify, NestJS, Nitro, Nuxt, Astro, SvelteKit, or Vite.
internal-dev-workbench
Spin up a portless + tmux dev session for the Workflow SDK that gives each git worktree isolated . .localhost URLs for the Next.js workbench and the observability UI, plus a Claude statusline that surfaces those URLs. Use only when the user asks for a "portless dev session", a "tmux dev layout for workflow"…