Borrowing it
Nothing to install: this file belongs to Sma1lboy/coforce-apply. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Sma1lboy/coforce-apply/main/.agents/skills/tracker/SKILL.mdgit clone --depth 1 https://github.com/Sma1lboy/coforce-applyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sma1lboy/coforce-apply/tracker)<a href="https://agentmods.dev/skills/sma1lboy/coforce-apply/tracker"><img src="https://agentmods.dev/badge/skills/sma1lboy/coforce-apply/tracker/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sma1lboy/coforce-apply/tracker"><img src="https://agentmods.dev/badge/skills/sma1lboy/coforce-apply/tracker.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00117 | $0.02743 |
| Opus 5.5 | $0.00047 | $0.01097 |
| Sonnet 5.5 | $0.00023 | $0.00549 |
| Haiku 4.5 | $0.00012 | $0.00274 |
Grade A, and why
tracker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 191 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tracker — local application board
Read ~/.coforce/instructions.md first if present — standing user instructions
(e.g. never-apply companies must not be added as pending).
Local truth: ~/.coforce/applications.json — a JSON array of applications:
{id, url, title, status, createdAt, updatedAt, company?, position?, notes?, needsFallback?, description?, deadline?, history?: [{date, event}]}. Missing
file → start with []. deadline is the posting's stated application
deadline as YYYY-MM-DD — only when the posting states one; never guess it
from "apply soon" or the posting date.
Operations
Add / update: read the JSON, apply the change, write back. id = epoch ms
string; always bump updatedAt (ISO). status is the pipeline stage ONLY:
pending → applied → interviewing → offer | rejected, and rejected means
one thing only: a company turned the user down. How delivery went is
never a status — an operator giving up is a history event plus
needsFallback: true (= a human has to take this one; cleared when the
application eventually goes out). Nor is fit: a posting screened out because
it contradicts the user's intent never entered the pipeline, so it does not
belong in this file at all — it goes to the start skill's screening ledger
(hunt.mjs screen <url> --reason "…", ledger at ~/.coforce/screened.json,
reversible with unscreen). Mixing the two makes the board claim rejections
that never happened. Put recruiter emails, interview dates, and
contacts in notes. When adding an application, save the JD text into
description if you have it. Every status change appends to history:
{date, event} (e.g. "status: applied → interviewing — recruiter email");
record submissions and interviews there too.
Console (看板 + 面板) — a React + Tailwind web app that ships with this
skill (web/, prebuilt web/dist included). The only launch entry point
is scripts/start_web.sh (relative to this skill's base directory, shown
when the skill loads):
"<skill-dir>/scripts/start_web.sh" # console on http://localhost:4517
open http://localhost:4517
PORT=… overrides the port; --dev starts the API plus a Vite dev server
with HMR on :5173 for working on the UI (web/src, needs bun or npm). The
script rebuilds dist automatically when sources changed and a package manager
exists; otherwise it serves the committed dist (end users never build).
board.mjs is the API server behind it — never invoke it directly from
skills. It only serves; a second hand-rolled HTML renderer used to exist for
a static single-file export and was deleted (git history has it).
One kobe-Hallmark-themed local site with these primary tabs:
- Board — kanban: full-height status columns, drag & drop moves an application (appends a history event, saves to the JSON), cards open a detail view (JD link, saved info, files, history timeline, description).
- Discover (home tab) — local job discovery: fetches the configured
sources through the start skill's
hunt.mjs(sibling install), lists postings not yet tracked (dedup + never-apply applied) with company logos.~/.coforce/config.jsonis the canonical settings file, normally pre-filled by the setup skill (level, directions, sponsorship, work mode, locations…); if it carries nolevela first-visit wizard collects level + directions, and console edits merge into it (POST /api/prefs) without touching keys the console does not show. Row icons resolve company-homepage logos via logo.dev whenlogoDevToken(publishable key) is set in config.json, falling back to the Google favicon service, then to an initials tile when the source list carried no homepage link. A left filter panel (search, level, direction with keyword classification, source) narrows the list, and a collapsible footer lists what the start skill's fit filter screened out — read from~/.coforce/screened.json, that skill's ledger — each with its reason, where Reconsider un-screens one (POST /api/screened/unscreen, which shells out tohunt.mjs unscreen) so it returns to discovery. The filter is never the last word. Each row's Build resume button queues the posting into both the tracker and current resume campaign. The next start/campaign cycle hydrates the JD and renders its matched resume; application submission remains a separate action. - Review — campaign dossier workspace: job queue, status and match score,
source-linked evidence shortlist, zoomable PDF proof, feedback/revision,
optional manual approval, and all-approved ZIP export. Settings can disable
the resume HITL gate, in which case complete PDFs auto-approve and the batch
ZIP auto-refreshes. It also shows the read-only Tier 0
experience-index status; campaigns never refresh GitHub. Campaign data lives
under
~/.coforce/campaigns/current/. - Profile — resume-style live preview of
~/.coforce/profile.jsonbeside a structured form editor (basics, skill chips, add/remove experience/project/education cards and bullets — no raw JSON). Its Resume skill policy ledger merges resume/coursework and Tier 0 skills, shows provenance, assigns the mandatory baseline and role packs, and keeps Save draft (review_requested) separate from explicit Approve policy. The same tab also provides "Import resume (AI)": pasted text is parsed by the local agent runtime (claude -p; binary overrideCOFORCE_CLAUDE_BIN) and fills the form for review before Save. - Instructions — edit
~/.coforce/instructions.mdin place. - Settings — runtime consents, editable minimum resume page coverage, required-vs-automatic resume review, LaTeX template, Tier 0 source scope, discovery preferences, and sources.
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- scripts/agent-runner.mjs 8.3 KB runs code
- scripts/board.mjs 31 KB runs code
- scripts/start_web.sh 1.2 KB runs code
- web/bun.lock 42 KB
- web/dist/assets/index-CDEDpUyA.js 77 KB runs code
- web/dist/assets/index-CI4mexsW.css 32 KB
- web/dist/assets/motion-BEPIQ9Do.js 126 KB runs code
- web/dist/assets/pdf-Dt0UaawZ.js 447 KB runs code
- web/dist/assets/pdf.worker.min-iDqQPrd3.mjs 1203 KB runs code
- web/dist/assets/react-SaLnwSRd.js 218 KB runs code
- web/dist/index.html 632 B
- web/index.html 302 B
- web/package.json 477 B
- web/src/App.jsx 3.4 KB
- web/src/components/ApplyDialog.jsx 12 KB
- web/src/index.css 3.4 KB
- web/src/lib/api.js 1.5 KB runs code
- web/src/lib/apply-feedback.js 1.0 KB runs code
- web/src/lib/classify.js 2.5 KB runs code
- web/src/main.jsx 187 B
- web/src/tabs/Board.jsx 8.6 KB
- web/src/tabs/Discover.jsx 15 KB
- web/src/tabs/Instructions.jsx 1.4 KB
- web/src/tabs/Profile.jsx 29 KB
- web/src/tabs/Review.jsx 23 KB
- web/src/tabs/Settings.jsx 11 KB
- web/vite.config.js 1.0 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 191 lines · 117 tokens per session scan A 73210f6cdaf3
tracker is a skill published in the GitHub repository Sma1lboy/coforce-apply (5 stars, last pushed 1mo ago), licensed MIT. It adds 117 tokens to every session and 2,743 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
story-readiness
Checks whether a story is ready to implement: clear acceptance criteria, no open questions, valid ADR and dependencies. Use when the user asks if a story, or the sprint's stories, are ready to start or build.
atmos-config
Atmos root configuration: atmos.yaml discovery, precedence, deep merging, basepath, imports, minimal bootstrap, and routing to narrower Atmos skills.
workthreads
SpecStory Workthreads - a weekly work-thread rollup across a team's repos from SpecStory coding histories (any agent - Claude Code, Codex, Cursor, Gemini, and more). It groups the window's sessions into threads of work per project and labels each new / open / recently closed, so a lead sees what shipped, what is still…
ring:mapping-feature-relationships
Mapping how features relate and phasing the work: categorizing PRD features, grouping them into domains, charting cross-feature journeys, dependencies, and integration points, and defining the binding Phases that plan.md mirrors one-to-one at Gate 7. Gate 2 of ring:planning-large-features; runs after…
qa-project-bootstrap
Onboard a new QA engineer to an existing codebase, or audit an existing test architecture. Produces a 30-day ramp plan: codebase orientation, framework walkthrough, test architecture audit, mentorship pairing, and first-test guidance. Use when: "QA onboarding," "new tester," "ramp up," "test architecture audit,"…
remove
Remove a deployed framework or addon from the current workspace.