malloy-discover

malloy-discover is a skill for Claude Code, Codex from malloydata/publisher. It costs 47 tokens per session (2,815 once invoked), scanned A, original, MIT.

A silent discovery step for Malloy, a language for describing data sources and asking questions about them.

In plain words
What is it for?
Use it to inspect existing Malloy models and profile data through Malloy queries before proposing what to model.
Why use it?
It builds an evidence-based understanding of tables, columns, values, and relationships before a data model is designed.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to inspect existing Malloy models and profile data through Malloy queries before proposing what to model.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/malloydata/publisher/malloy-discover
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add malloydata/publisher --skill malloy-discover
Clone the repo
git clone --depth 1 https://github.com/malloydata/publisher

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for malloy-discover

README.md
[![agentmods](https://agentmods.dev/badge/skills/malloydata/publisher/malloy-discover/github.svg)](https://agentmods.dev/skills/malloydata/publisher/malloy-discover)
Your own site
<a href="https://agentmods.dev/skills/malloydata/publisher/malloy-discover"><img src="https://agentmods.dev/badge/skills/malloydata/publisher/malloy-discover/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for malloy-discover

Your own site · 80×15
<a href="https://agentmods.dev/skills/malloydata/publisher/malloy-discover"><img src="https://agentmods.dev/badge/skills/malloydata/publisher/malloy-discover.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 47 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,815 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 1 finding, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium Excessive Agency · line 48
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00047 $0.02815
Opus 5 $0.00023 $0.01407
Sonnet 5 $0.00009 $0.00563
Haiku 4.5 $0.00005 $0.00281

Measured 9d ago against content hash 581664328563, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

malloy-discover scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/malloy-discover/SKILL.md · 195 lines

How it starts

The opening of the file, as written. The whole thing — 195 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Data Discovery (Step 1, Silent)

CRITICAL: Read the model before writing ANY Malloy code. The model defines the sources, connection names, and fields. Never guess connection names.

Tool names are written bare here - get_context, execute_query, search_malloy_docs. The exact prefixed name depends on the host surface; match each against the tools you actually have.

PREREQUISITE: Make sure the Malloy MCP tools (get_context, execute_query, search_malloy_docs) are configured and reachable. If they are not, stop and resolve the MCP connection before continuing.

This step is silent. The agent does not present findings to the user yet. That happens in the next step (PROPOSE SCOPE). Silent does not mean unrecorded: append findings to your modeling workflow's modeling-notes.md as you go (grain proofs, key collisions, coverage cliffs, metadata drift, problems) so the scope proposal argues from a durable record rather than a reconstruction.

Profiling goes through Malloy. Even when the underlying engine is available directly (a duckdb CLI, psql, bq), run discovery queries through execute_query. The semantic layer under construction is the product, and grounded discovery through it is the point; profiling around it is a category error, not a shortcut: every finding would have to be re-verified through Malloy anyway.

Tools

  • get_context: Ground yourself in the package's sources, views, and fields (with their docs). Call FIRST. The sources and their join paths are the schema you build on.
  • execute_query: Run ad-hoc queries to preview data, verify values, check NULLs, validate assumptions.
  • search_malloy_docs: Get Malloy syntax help when needed.

Workflow

1. Check for prior art signals                 → BI configs, metadata files, KPI docs, catalog
                                                 exports, READMEs, screenshots. Ask before using.
2. If BI config: read adapter reference        → Follow skill:malloy-lookml-review; read anything
                                                 else directly. Notes into modeling-notes.md
3. get_context                           → Ground yourself: sources, views, fields
4. Inspect source definitions                  → See ALL fields and join paths for key sources
5. Derive candidate joins/dimensions/measures  → Read them off the model and the data, not a suggestion tool
6. Define a minimal source if one is missing   → Just enough to run execute_query for previews
7. execute_query(query)                  → Preview data, verify values, check NULLs, check duplicates
8. search_malloy_docs(query)                    → Get syntax help when needed
9. Proceed to Step 2 (PROPOSE SCOPE)

Read the full file on GitHub · 195 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 195 lines · 47 tokens per session scan A 581664328563

Subscribe to this mod's changes

malloy-discover is a skill published in the GitHub repository malloydata/publisher (100 stars, last pushed today), licensed MIT. It adds 47 tokens to every session and 2,815 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

reimagine-it-extract

Emit the content signals reimagine-it reads from an HTML file — title, anchors, proper nouns, dates, numbers, emails, links, source hex colors, and the derived palette — as JSON without generating a redesign. Use when the user says /reimagine-it extract, "what does the engine see in this page", "extract the palette"…

Kayforkind/reimagine-it · 133 tokens

text-processing

Transform, filter, sort, and analyze text using sed, awk, sort, uniq, cut, tr, wc, and other text processing tools. Use when the user asks to find and replace text in files, extract columns from data, count lines or words, sort and deduplicate output, reformat delimited data, perform field-based calculations, or build…

bug-ops/zeph · 79 tokens

reusable-visualization

Build ONE reusable chart visualization component that receives its data and its settings from the host application instead of fetching them, and declares the fields and config options the host exposes to viewers. Use this whenever a single chart component is reused across many different queries rather than built for…

lightdash/lightdash · 102 tokens

lightdash-agent-slack-messaging

Use this skill when writing, designing, or generating Slack messages for Lightdash's in-app analytics agent. Triggers when someone asks to create agent update messages, Slack digests, agent notifications, weekly summaries, daily summaries, or any Slack copy for the Lightdash project agent. Also use when asked to vary…

lightdash/lightdash · 114 tokens

developing-in-lightdash

Use when reading, creating, and editing Lightdash dashboards and charts as JSON, including dashboard layout and chart-type-specific configuration.

lightdash/lightdash · 31 tokens

upgrade-preflight

Checks whether a self-hosted Lightdash upgrade is safe to run, and reads the tooling's answer without over-reading it. Use when upgrading a self-hosted instance, planning a maintenance window, answering "is this upgrade safe", or recovering a failed, hung, parked or lock-stuck migration — covers lightdash…

lightdash/lightdash · 101 tokens