Agent skill · Audited from source

coverage-tracker-setup

skill · elvisun/newsjackMIT licenceAudited 22 Oct 2026 · source d9b73ba47e88

★ 1,638pushed 1 day ago
!CAUTIONGrade B · 89/100 · 4 findings · d9b73ba
1,638repo stars · whole elvisun/newsjack

Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit d9b73ba47e88 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 4 findings, 0 critical or high. What it does: Set up a lightweight Google Alerts-style coverage tracker for any number of keywords. Creates a tracker config with each keyword and what it actually means, then hands recurrence to the user's agent harness.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “coverage-tracker-setup (elvisun/newsjack)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/elvisun/coverage-tracker-setup

Trust audit

Audit 0.4.1 · source read 22 Oct 2026

Trust score89/100!CAUTION B
0 critical0 high3 medium1 low0 info

CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityWARN2
L1 Static sourceSecrets, path traversal, supply chain, hidden codeNA0
L2 InstructionsPrompt injection, authority framing, hidden directivesWARN2
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: no behavioural pass.

Findings (4)

MEDIUMPrivilege escalation / persistencereview.unsafe_action · SKILL.md
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L2
run `newsjack --version`; if that's not on `PATH`, try the bundled location `~/.newsjack/bin/newsjack --version` and use that full path everywhere if it works
Why
Instructs the agent to execute an external bundled binary without first asking the user to authorize running that program.
Fix
rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWPrompt injectionprompt.hide_from_user · SKILL.md:20
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **You're in a plain chat window** (Claude.ai, ChatGPT, Claude Cowork, or anything without file/command access). Here you can only draft. Write out the tracker config and the schedule prompt, then te
Why
asks the agent to act without the user's knowledge
Fix
—

Audit 0.4.1 · source sha d9b73ba47e88 · 22 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherelvisun GitHub userOwner of the repository this skill is read from
  • Source folderelvisun/newsjack/skills/coverage-tracker-setupThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdictd9b73ba47e88A new audit runs when the source changes
  • Repository statusNot archivedLast push 1 day ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Set up a lightweight Google Alerts-style coverage tracker for any number of keywords. Creates a tracker config with each keyword and what it actually means, then hands recurrence to the user's agent harness.

---
name: coverage-tracker-setup
description: "Set up a lightweight Google Alerts-style coverage tracker for any number of keywords. Creates a tracker config with each keyword and what it actually means, then hands recurrence to the user's agent harness."
when_to_use: "User wants to create, configure, or update coverage alerts, brand/company mention tracking, Google Alert-style monitoring, or keyword coverage tracking. Use this instead of newsjack-monitor-setup when the job is to track coverage of the user's own keywords rather than find newsjacking opportunities."
metadata:
  category: Detect
---

# Coverage Tracker Setup

This sets up a simple keyword tracker that the `coverage-tracker` skill runs for you. Think of it like a Google Alert: it watches for new coverage of the keywords you care about and tells you when something real shows up.

It is deliberately a different job from setting up newsjack monitoring. A coverage tracker answers "did my keyword get real coverage?" Newsjack monitoring (`newsjack-monitor-setup`) answers a bigger question: "can my company jump into a broader news story?" If the user wants the second one, use that skill instead.

## Where you're running this

Two situations, and they change what you can finish here:

- **You can save files and run commands** (Claude Code, Codex, OpenClaw, Hermes, or a similar setup with shell, file, and network access). Here you can do the whole thing: save the tracker, run it once, and hand the recurring schedule to your agent. **Before you decide you can't run the CLI, check whether `newsjack` is installed.** It ships as a prebuilt, bundled binary — you do **not** need Go, a compiler, or any build/install step. Never look for a Go toolchain or tell the user they need a "Go environment" without checking first: run `newsjack --version`; if that's not on `PATH`, try the bundled location `~/.newsjack/bin/newsjack --version` and use that full path everywhere if it works. The bundled binary is almost always already installed — verify, don't assume it's missing.
- **You're in a plain chat window** (Claude.ai, ChatGPT, Claude Cowork, or anything without file/command access). Here you can only draft. Write out the tracker config and the schedule prompt, then tell the user to move to a setup that can save and run things. Don't try to install or run anything, and don't tell the user it was saved or scheduled when it wasn't.

## What to ask the user

Only ask for what you don't already know:

- a name for the tracker
- the keywords to watch (as many as they want)
- for each keyword, one short note on what it actually means: which company, product, or person should it point to? This is what later filters out wrong matches.
- optionally, words or uses to ignore when a keyword is ambiguous (for example, a common word that also happens to be a brand name)
- how often to check: every morning, twice a day, or hourly

Don't ask about company standing, spokespeople, competitors, proof assets, news feeds, target reporters, or story angles. All of that is for newsjacking, not for tracking coverage of your own keywords.

## Steps to set it up

1. **Write the tracker config.** This is a small file that the `coverage-tracker` skill reads back every time it runs, so keep its shape exactly as shown:

   ```json
   {
     "name": "Profound",
     "lookback_days": 2,
     "keywords": [
       {
         "keyword": "profound",
         "means": "Profound, the AI search analytics company.",
         "exclude_hints": ["generic adjective uses"]
       }
     ]
   }
   ```

   You can list as many keywords as you want. The `means` line for each one matters: make it specific (which company, product, or person) so the tracker can later throw out mentions of the wrong thing or generic uses of the word.

   If you're in a plain chat window, stop here. Hand the user this config plus the schedule prompt from step 3, and tell them to finish in a setup that can save and run things. Don't claim it was saved or scheduled.

2. **Save the config** with this command (replace `<slug>` with a short name for the tracker):

   ```bash
   newsjack coverage init <slug> --config tracker.json
   ```

   Working inside a copy of the project source, use `bin/newsjack` from the project root instead. Only add `--force` if the user clearly wants to overwrite a tracker that already exists.

3. **Schedule the recurring check through your agent, not your computer's built-in scheduler.** If your agent has a way to schedule prompts, schedule this one:

   ```text
   Use the coverage-tracker skill for <slug>.
   ```

   If your agent can't schedule things itself, tell the user exactly which prompt to set up on a schedule in Claude, Codex, Hermes, OpenClaw, or whatever they use. Do not set up system-level schedulers (cron, launchd, systemd timers, or similar) on the user's machine.

4. **Run it once right away** if the user wanted a working setup, or if you're doing the whole setup end to end. Use the `coverage-tracker` skill for the new slug and tell the user what the first run found.

## Updating a tracker you already have

First, look up where the config lives:

```bash
newsjack coverage status <slug>
```

That shows a `config_path`. Open the config file there, make your edits, then save it again with:

```bash
newsjack coverage init <slug> --config tracker.json --force
```

Only change the keywords or their meaning notes. The record of what's already been seen and alerted on is kept separately by `coverage-tracker` (in its own database) — don't edit that by hand.

## What to tell the user when you're done

Wrap up by giving them:

- the tracker slug (its short name)
- where the config file is saved
- the schedule prompt and how often it'll run
- what the first run found, if you ran it

Excerpt, first 5,790 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit d9b73ba

Download folder ↗
git clone https://github.com/elvisun/newsjack
git -C newsjack checkout d9b73ba47e88

The author documents no install command, so this uses the repository directly. Our verdict covers commit d9b73ba47e88 only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
Claude CodeMentioned in its text, not testedSkills for Claude Code · About Claude Code
CodexMentioned in its text, not testedSkills for Codex · About Codex
OpenClawMentioned in its text, not testedSkills for OpenClaw · About OpenClaw
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. !CAUTION B 89 / 100

    first audit · source d9b73ba47e88

README badge

For maintainers · shows the latest audit

ModelsAtlas: CAUTION BMODELSATLASCAUTION · B
[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/badge.svg)](https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/)

The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.

Similar skills

newsjack-triage✓SAFE

elvisun/newsjack

Consolidate freshness-gated newsjack signals and route them by client standing before angle generation. Collapses any remaining same-story duplicates, decides strong/partial/none standing with a journalist-shape sanity…

★ 1.7kGrade B
meanest-editor✓SAFE

elvisun/newsjack

Roast a pitch or press release with the eye of a veteran PR director. Honest, sharp, constructive — never cruel for its own sake.

★ 1.7kGrade B
news-search✓SAFE

elvisun/newsjack

Search current news for a topic, company, competitor, or hook and return dated, attributed articles. Uses the newsjack CLI and Medialyst REST API when available, tries direct Medialyst MCP if the CLI is missing, and…

★ 1.7kGrade B
journalist-fit-check✓SAFE

elvisun/newsjack

Gate a pitch against one journalist at a time. Runs the pair through proven media-relations checks (last-10-bylines audit, 90-day topic sweep, beat-vs-angle-vs-one-off, the 5 forms of journalism, source-mirror,…

★ 1.7kGrade B
headline-generator✓SAFE

elvisun/newsjack

Generate headline candidates from a story's raw facts: news-style headlines, press-release headlines, and pitch subject lines. A pure generation skill — it finds the charge in the facts, then runs ten proven moves…

★ 1.7kGrade B
find-journalists✓SAFE

elvisun/newsjack

Build a researched, fit-checked journalist list for a specific PR campaign. Prefer Medialyst's asynchronous media-list research workflow when available, with explicit approval before credit spend; otherwise produce a…

★ 1.6kGrade B

Add this badge to your README

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/badge.svg)](https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/)

Questions about coverage-tracker-setup

What does the coverage-tracker-setup skill do?
The open-source skills that turn your agent into a full PR team.
Is coverage-tracker-setup safe to install?
With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can coverage-tracker-setup access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does coverage-tracker-setup work with?
Its documentation mentions claude-code, codex and openclaw. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (d9b73ba47e88), read on 2026-10-22. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.