Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tripsyapp/cli/tripsynpx skills add tripsyapp/cli --skill tripsygit clone --depth 1 https://github.com/tripsyapp/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00034 | $0.05533 |
| Opus 5 | $0.00017 | $0.02766 |
| Sonnet 5 | $0.00007 | $0.01107 |
| Haiku 4.5 | $0.00003 | $0.00553 |
Grade C, and why
tripsy scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://tripsy.app/install_cli | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://tripsy.app/install_cli | bash How it starts
The opening of the file, as written. The whole thing — 517 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tripsy CLI Agent Skill
Use this skill when an agent needs to inspect, create, update, or organize Tripsy data through the local tripsy CLI or tripsy-mcp server.
The CLI and MCP server talk to the public Tripsy API at https://api.tripsy.app. Public API paths do not include an /api prefix.
Operating Rules
- Prefer
tripsy-mcptyped tools when the current client supports MCP. - Prefer friendly CLI commands over
tripsy requestwhen a wrapper exists. - Use
--jsonfor agent-readable output. Use--quietonly when rawdatais needed without the envelope. - Read the
ok,summary,data, andbreadcrumbsfields from JSON envelopes. - Follow
breadcrumbswhen navigating related resources. - Do not print stored tokens unless the user explicitly asks for token output.
- Do not ask the user for passwords in chat. Ask them to run
tripsy auth login --username USERNAMElocally, or useTRIPSY_TOKEN. - Use exact ISO-8601 UTC datetimes for every timed value, for example
2026-06-03T09:00:00Z. Always pair them with the relevant local IANA timezone field (timezone,departure_timezone, orarrival_timezone). - When displaying activity or lodging dates/times from MCP data, convert UTC
starts_atandends_atinto the item'stimezonebefore formatting local date/time. - When displaying transportation dates/times from MCP data, convert UTC
departure_atwithdeparture_timezoneand UTCarrival_atwitharrival_timezone; do not apply one endpoint's timezone to the other endpoint unless the fields explicitly match. - For trip dates, use date strings such as
2026-06-01. trips listreturns trips where the authenticated user is travelling. Usetrips followingfor trips the user follows but is not travelling on.has_datesis authoritative. Ifhas_datesisfalse, ignorestarts_atandends_ateven when those fields are present.- When creating a destination trip, choose a beautiful destination-specific Unsplash image and set it as
cover_image_url. - Use a real direct Unsplash CDN URL copied from an image result, in the form
https://images.unsplash.com/photo-1562869929-bda0650edb1f?ixid=...&ixlib=rb-4.1.0. Tripsy will add the needed rendering parameters. - The
images.unsplash.compath must bephoto-<numeric timestamp>-<asset hash>. Do not use the Unsplash page URL, and do not turn short photo IDs likenWdsya5_Ymsintohttps://images.unsplash.com/photo-nWdsya5_Yms. - Before saving a trip
cover_image_url, validate that it is a real direct Unsplash CDN URL. If the client has external URL access, also confirm the image URL is reachable and not returning a404. - For itinerary planning, set trip dates whenever day-by-day timed planning is needed. If the user did not provide dates but asks for a planned itinerary, choose explicit reasonable dates and state them.
- Create one item per actual stop, reservation, meal, tour, or activity. Do not create one activity that bundles a full day or multiple places.
- Set
latitudeandlongitudefor every activity; MCP rejects activity creation without both coordinates so Tripsy's map is populated. - Set
latitudeandlongitudefor every known hosting and transportation point so Tripsy's map is populated. - Use the most specific supported category slug for Activity
activity_type; do not default togeneralortourwhen a better category exists. - Activities can use either a built-in
activity_typeslug or a visible custom category slug. Custom category slugs are only valid on Activity objects throughactivity_type; do not use them for lodging, transportation, expenses, or trips. If an activity has anactivity_typeoutside the built-in list, fetch visible custom categories throughtripsy_categories_listortripsy categories listand resolve the slug there before displaying the category name, icon, or color. - Use
hostingsfor hotels/lodging. The lodging category slug islodging. - Use
transportationsfor point-to-point movement such as flights, trains, cars, buses, cruises, ferries, roadtrips, walks, and similar travel. - For flights, create a transportation with
transportation_typeset toairplane, setdeparture_descriptionandarrival_descriptionto the airport IATA codes, include each airport's latitude and longitude, and omitnameunless the user provided one. - For transfer activities, create a transportation with
transportation_typeset toroadtrip, and fill both departure and arrival locations with name/description, address, latitude, and longitude. - Delete operations can be executed when requested. Tripsy deletes are recoverable, so they can be undone if necessary. State what will be deleted before running the command when the user has not already been explicit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 517 lines · 34 tokens per session scan C 5ab27da2c61d
tripsy is a skill published in the GitHub repository tripsyapp/cli (15 stars, last pushed 13d ago), licensed MIT. It adds 34 tokens to every session and 5,533 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…