Agent skill · Audited from source
coverage-tracker-setup
skill · elvisun/newsjackMIT licenceAudited 22 Oct 2026 · source d9b73ba47e88
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit d9b73ba47e88 and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 4 findings, 0 critical or high. What it does: Set up a lightweight Google Alerts-style coverage tracker for any number of keywords. Creates a tracker config with each keyword and what it actually means, then hands recurrence to the user's agent harness.
Cite
Cite this page
ModelsAtlas. “coverage-tracker-setup (elvisun/newsjack)”. Retrieved 22 Oct 2026. https://modelsatlas.com/skills/elvisun/coverage-tracker-setup
Trust audit
Audit 0.4.1 · source read 22 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | WARN | 2 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | WARN | 2 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (4)
MEDIUMInventory / provenanceinv.symlink · plugins/newsjack/.mcp.json
plugins/newsjack/.mcp.json
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · plugins/newsjack/skills
plugins/newsjack/skills
- Why
- link not followed
- Fix
- —
MEDIUMPrivilege escalation / persistencereview.unsafe_action · SKILL.md
run `newsjack --version`; if that's not on `PATH`, try the bundled location `~/.newsjack/bin/newsjack --version` and use that full path everywhere if it works
- Why
- Instructs the agent to execute an external bundled binary without first asking the user to authorize running that program.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWPrompt injectionprompt.hide_from_user · SKILL.md:20
- **You're in a plain chat window** (Claude.ai, ChatGPT, Claude Cowork, or anything without file/command access). Here you can only draft. Write out the tracker config and the schedule prompt, then te
- Why
- asks the agent to act without the user's knowledge
- Fix
- —
Audit 0.4.1 · source sha d9b73ba47e88 · 22 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherelvisun GitHub userOwner of the repository this skill is read from
- Source folderelvisun/newsjack/skills/coverage-tracker-setupThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdictd9b73ba47e88A new audit runs when the source changes
- Repository statusNot archivedLast push 1 day ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Set up a lightweight Google Alerts-style coverage tracker for any number of keywords. Creates a tracker config with each keyword and what it actually means, then hands recurrence to the user's agent harness.
---
name: coverage-tracker-setup
description: "Set up a lightweight Google Alerts-style coverage tracker for any number of keywords. Creates a tracker config with each keyword and what it actually means, then hands recurrence to the user's agent harness."
when_to_use: "User wants to create, configure, or update coverage alerts, brand/company mention tracking, Google Alert-style monitoring, or keyword coverage tracking. Use this instead of newsjack-monitor-setup when the job is to track coverage of the user's own keywords rather than find newsjacking opportunities."
metadata:
category: Detect
---
# Coverage Tracker Setup
This sets up a simple keyword tracker that the `coverage-tracker` skill runs for you. Think of it like a Google Alert: it watches for new coverage of the keywords you care about and tells you when something real shows up.
It is deliberately a different job from setting up newsjack monitoring. A coverage tracker answers "did my keyword get real coverage?" Newsjack monitoring (`newsjack-monitor-setup`) answers a bigger question: "can my company jump into a broader news story?" If the user wants the second one, use that skill instead.
## Where you're running this
Two situations, and they change what you can finish here:
- **You can save files and run commands** (Claude Code, Codex, OpenClaw, Hermes, or a similar setup with shell, file, and network access). Here you can do the whole thing: save the tracker, run it once, and hand the recurring schedule to your agent. **Before you decide you can't run the CLI, check whether `newsjack` is installed.** It ships as a prebuilt, bundled binary — you do **not** need Go, a compiler, or any build/install step. Never look for a Go toolchain or tell the user they need a "Go environment" without checking first: run `newsjack --version`; if that's not on `PATH`, try the bundled location `~/.newsjack/bin/newsjack --version` and use that full path everywhere if it works. The bundled binary is almost always already installed — verify, don't assume it's missing.
- **You're in a plain chat window** (Claude.ai, ChatGPT, Claude Cowork, or anything without file/command access). Here you can only draft. Write out the tracker config and the schedule prompt, then tell the user to move to a setup that can save and run things. Don't try to install or run anything, and don't tell the user it was saved or scheduled when it wasn't.
## What to ask the user
Only ask for what you don't already know:
- a name for the tracker
- the keywords to watch (as many as they want)
- for each keyword, one short note on what it actually means: which company, product, or person should it point to? This is what later filters out wrong matches.
- optionally, words or uses to ignore when a keyword is ambiguous (for example, a common word that also happens to be a brand name)
- how often to check: every morning, twice a day, or hourly
Don't ask about company standing, spokespeople, competitors, proof assets, news feeds, target reporters, or story angles. All of that is for newsjacking, not for tracking coverage of your own keywords.
## Steps to set it up
1. **Write the tracker config.** This is a small file that the `coverage-tracker` skill reads back every time it runs, so keep its shape exactly as shown:
```json
{
"name": "Profound",
"lookback_days": 2,
"keywords": [
{
"keyword": "profound",
"means": "Profound, the AI search analytics company.",
"exclude_hints": ["generic adjective uses"]
}
]
}
```
You can list as many keywords as you want. The `means` line for each one matters: make it specific (which company, product, or person) so the tracker can later throw out mentions of the wrong thing or generic uses of the word.
If you're in a plain chat window, stop here. Hand the user this config plus the schedule prompt from step 3, and tell them to finish in a setup that can save and run things. Don't claim it was saved or scheduled.
2. **Save the config** with this command (replace `<slug>` with a short name for the tracker):
```bash
newsjack coverage init <slug> --config tracker.json
```
Working inside a copy of the project source, use `bin/newsjack` from the project root instead. Only add `--force` if the user clearly wants to overwrite a tracker that already exists.
3. **Schedule the recurring check through your agent, not your computer's built-in scheduler.** If your agent has a way to schedule prompts, schedule this one:
```text
Use the coverage-tracker skill for <slug>.
```
If your agent can't schedule things itself, tell the user exactly which prompt to set up on a schedule in Claude, Codex, Hermes, OpenClaw, or whatever they use. Do not set up system-level schedulers (cron, launchd, systemd timers, or similar) on the user's machine.
4. **Run it once right away** if the user wanted a working setup, or if you're doing the whole setup end to end. Use the `coverage-tracker` skill for the new slug and tell the user what the first run found.
## Updating a tracker you already have
First, look up where the config lives:
```bash
newsjack coverage status <slug>
```
That shows a `config_path`. Open the config file there, make your edits, then save it again with:
```bash
newsjack coverage init <slug> --config tracker.json --force
```
Only change the keywords or their meaning notes. The record of what's already been seen and alerted on is kept separately by `coverage-tracker` (in its own database) — don't edit that by hand.
## What to tell the user when you're done
Wrap up by giving them:
- the tracker slug (its short name)
- where the config file is saved
- the schedule prompt and how often it'll run
- what the first run found, if you ran itExcerpt, first 5,790 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit d9b73ba
git clone https://github.com/elvisun/newsjack git -C newsjack checkout d9b73ba47e88
The author documents no install command, so this uses the repository directly. Our verdict covers commit d9b73ba47e88 only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
| OpenClaw | Mentioned in its text, not tested | Skills for OpenClaw · About OpenClaw |
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
d9b73ba47e88
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
elvisun/newsjack
Consolidate freshness-gated newsjack signals and route them by client standing before angle generation. Collapses any remaining same-story duplicates, decides strong/partial/none standing with a journalist-shape sanity…
elvisun/newsjack
Roast a pitch or press release with the eye of a veteran PR director. Honest, sharp, constructive — never cruel for its own sake.
elvisun/newsjack
Search current news for a topic, company, competitor, or hook and return dated, attributed articles. Uses the newsjack CLI and Medialyst REST API when available, tries direct Medialyst MCP if the CLI is missing, and…
elvisun/newsjack
Gate a pitch against one journalist at a time. Runs the pair through proven media-relations checks (last-10-bylines audit, 90-day topic sweep, beat-vs-angle-vs-one-off, the 5 forms of journalism, source-mirror,…
elvisun/newsjack
Generate headline candidates from a story's raw facts: news-style headlines, press-release headlines, and pitch subject lines. A pure generation skill — it finds the charge in the facts, then runs ten proven moves…
elvisun/newsjack
Build a researched, fit-checked journalist list for a specific PR campaign. Prefer Medialyst's asynchronous media-list research workflow when available, with explicit approval before credit spend; otherwise produce a…
Add this badge to your README
[](https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/)
<a href="https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/"><img src="https://modelsatlas.com/skills/elvisun/coverage-tracker-setup/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about coverage-tracker-setup
What does the coverage-tracker-setup skill do?
Is coverage-tracker-setup safe to install?
What can coverage-tracker-setup access on my machine?
Which assistants does coverage-tracker-setup work with?
How current is this page?
Sources
- github.com/elvisun/newsjack/tree/main/skills/coverage-tracker-se — the audited source at commit d9b73ba47e88 and every finding aboveObserved · 22 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the coverage-tracker-setup skill do?
- Is coverage-tracker-setup safe to install?
- What can coverage-tracker-setup access on my machine?