TicketsatworkCAUTION

AI-powered travel hacking and search with cash, points, miles, and award flights. Drop-in skills and MCP servers for Claude, Codex, and OpenCode.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ticketsatwork
description: Search TicketsAtWork (EBG corporate perks) for hotels, theme park tickets, attractions, and rental cars via Patchright. Often beats portals by 10-30%. Use when comparing hotel or ticket prices for a trip.
category: hotels
summary: TicketsAtWork (EBG) corporate-perks portal. Hotels, theme park tickets, attractions, live events. Often beats portals by 10-30%.
api_key: None (requires TaW account + Patchright)
docker_image: ghcr.io/borski/ticketsatwork
allowed-tools: Bash(docker *), Bash(python3 *)
---

# TicketsAtWork

Scrapes inventory from [ticketsatwork.com](https://www.ticketsatwork.com), a corporate employee perks platform operated by Entertainment Benefits Group (EBG). Members access negotiated rates through their employer's account.

**No public API.** Patchright (undetected Playwright fork) is required because TaW is behind bot protection that blocks `requests`, vanilla Playwright, and headless Chrome.

## Why TaW matters for travel hacking

TaW aggregates inventory from EBG's negotiated wholesale pool (similar inventory feeds as Costco Travel, AAA, etc.). On the same property + dates, TaW often beats:
- The hotel's direct booking
- Booking.com / Hotels.com / Expedia
- Chase Travel (UR portal) and Amex Travel (MR portal)
- Even Amex FHR / THC and Chase Edit on properties not in those programs

Discount badges are typically genuine: the "Save $X" amount is computed against the hotel's published rate at search time.

**Tradeoff:** No portal credits, no card-program elite benefits, no points earning on the stay. You earn TaW "Funlife" loyalty points usable at ~1 cpp on future TaW bookings only.

## Capabilities

| Subcommand | What it does | Status |
|------------|--------------|--------|
| `hotels` | Hotel search by city + date range. Returns ~10-200+ properties with prices, savings vs strike rate, lat/lng, ratings, distance | Stable |
| `cars` | Rental car search by pickup location + date/time range | **Experimental.** TaW resolves the autocomplete latlng but not always the airport code their car backend needs. Some valid-looking searches return "no cars at this location" even for major airports. See "Known limitations" below. |
| `tickets` | Browse a category landing page (e.g. `disneyland`, `wdw`, `usf`) or keyword-search via Reflektion | Stable. Returns deal title, savings claim, description, image, detail URL. **Prices are not on the listing**, they appear on the detail page. |

## Prerequisites

- Docker running locally (for the published image) OR Patchright installed locally (`pip install patchright && patchright install chromium`)
- A TaW account (created via your employer's TaW URL or corporate code)
- TaW email + password set as `TAW_USER` and `TAW_PASS` environment variables

## Authentication

Form-based email + password. The skill submits the login form via JavaScript directly. Each script run uses a fresh browser profile, so each run logs in fresh.

The visible "Sign in / Register" UI requires modal interactions that Patchright handles unreliably (cookie banner overlap, modal trigger visibility issues). The login form (`#member_login_form`) is in the DOM at all times, so we set values via JS and click the form's submit button.

## Docker Usage

```bash
docker pull ghcr.io/borski/ticketsatwork:latest

# Hotels
docker run --rm -e TAW_USER -e TAW_PASS \
  ghcr.io/borski/ticketsatwork hotels \
  --city "Carlsbad, CA" --checkin 2027-03-04 --checkout 2027-03-07 \
  --rooms 1 --adults 2 --json

# Tickets / attractions (category)
docker run --rm -e TAW_USER -e TAW_PASS \
  ghcr.io/borski/ticketsatwork tickets \
  --category disneyland --json

# Tickets / attractions (keyword)
docker run --rm -e TAW_USER -e TAW_PASS \
  ghcr.io/borski/ticketsatwork tickets \
  --keyword "universal studios" --json

# Live events in destination cities (concerts, theater, sports)
docker run --rm -e TAW_USER -e TAW_PASS \
  ghcr.io/borski/ticketsatwork tickets \
  --section events --json

# Rental cars (experimental)
docker run --rm -e TAW_USER -e TAW_PASS \
  ghcr.io/borski/ticketsatwork cars \
  --pickup "San Diego Airport, CA" \
  --pickup-date 2026-06-15 --pickup-time 12:00 \
  --dropoff-date 2026-06-18 --dropoff-time 12:00 \
  --age 30 --json
```

## Local Usage (opens a Chrome window briefly)

```bash
# Hotels
[email protected] TAW_PASS=yourpass \
  python3 scripts/search_hotels.py --city "Carlsbad, CA" \
  --checkin 2027-03-04 --checkout 2027-03-07 --json

# Tickets
[email protected] TAW_PASS=yourpass \
  python3 scripts/browse_tickets.py --category disneyland --json

# Cars
[email protected] TAW_PASS=yourpass \
  python3 scripts/search_cars.py \
  --pickup "San Diego Airport, CA" \
  --pickup-date 2026-06-15 --pickup-time 12:00 \
  --dropoff-date 2026-06-18 --dropoff-time 12:00 --json
```

## Hotels: arguments and output

### Arguments

| Flag | Required | Default | Description |
|------|----------|---------|-------------|
| `--city` | yes |  | City or address. Goes into the destination autocomplete. |
| `--checkin` | yes |  | Check-in date in `YYYY-MM-DD`. |
| `--checkout` | yes |  | Check-out date in `YYYY-MM-DD`. |
| `--rooms` | no | 1 | Number of rooms. |
| `--adults` | no | 2 | Adults per room. |
| `--children` | no | 0 | Children per room. |
| `--json` | no | off | Structured JSON instead of a human-readable table. |
| `--debug` | no | off | Save screenshots + HTML at each step to `/output` (Docker) or `/tmp/taw_debug/` (local). |
| `--raw-html-out` | no |  | Write the raw results HTML to a file for offline analysis. |

### Output schema (JSON mode)

```json
{
  "city": "Carlsbad, CA",
  "checkin": "2027-03-04",
  "checkout": "2027-03-07",
  "rooms": 1,
  "adults": 2,
  "children": 0,
  "display_pages": 14,
  "listing_count": 134,
  "listings": [
    {
      "id": "hotel_NNNNNN_x",
      "name": "Property Display Name",
      "name_normalized": "property display name",
      "rating": 4.5,
      "guest_rating": 9.0,
      "price

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

declared (3 observation(s))

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

.agents/skills

.claude/skills

.opencode/skills

skills

AGENTS.md

Gates applied: no_behavioural_pass.