Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add malloydata/publisher --skill malloy-materializationgit clone --depth 1 https://github.com/malloydata/publisherWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/malloydata/publisher/malloy-materialization)<a href="https://agentmods.dev/skills/malloydata/publisher/malloy-materialization"><img src="https://agentmods.dev/badge/skills/malloydata/publisher/malloy-materialization/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/malloydata/publisher/malloy-materialization"><img src="https://agentmods.dev/badge/skills/malloydata/publisher/malloy-materialization.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.03711 |
| Opus 5.5 | $0.00037 | $0.01484 |
| Sonnet 5.5 | $0.00018 | $0.00742 |
| Haiku 4.5 | $0.00009 | $0.00371 |
Grade B, and why
malloy-materialization scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Strips warnings and disclaimersmediumAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
2. **The declaring model is missing the persistence flag** and nothing flagged imports it: skipped without any warning, the run succeeds, the source is simply absent from what was built. Add the flag to the declaring fil How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Materialization (Malloy Persistence)
Materialize an expensive source once so queries read a pre-built table instead of recomputing it every time. You tag a source #@ persist, a materialization run builds it into a physical table, and queries against it are rewritten to read that table.
The #1 gotcha, up front: if a persist source isn't materializing, it is almost always one of four things - no build ever ran (a standalone Publisher does not build on publish - see Building and refreshing), a build ran and failed or lost that one source (a run can finish ready with
failures; read them), the model declaring the source has no##! experimental.persistenceflag and nothing flagged imports it (it is skipped without a warning), or the package was reloaded since the build (a reload drops the bindings until the next run). Jump to Debugging a no-op build.
This file is the core. The details live beside it, one topic per file, and each is a prompt of its own:
reference/annotation.md- the#@ persisttag: what can carry it, the name rules, identity and reuse, readers of a persisted source, and every option with where it is explained.reference/policy.md- thepublisher.jsonblock:scope,queryMetadata, and where the rules are enforced.reference/storage.md- building into a storage destination (storage=),partition=, where a given may sit, which sources that tier refuses, and how a stored table is served.reference/chaining.md- one stored source built over another stored source: what makes it reuse the parent's table or recompute from the warehouse, and how to read which happened.reference/refresh.md- keeping a table current:freshness,schedule, andrefresh="incremental".reference/access-filter.md- persisting a#(access_filter)-gated source, and the bound on a stale access decision.reference/tuning.md- reading the materialization history to decide what to persist, stop persisting, or reschedule (recommendations only).
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed · -58 lines · +26 tokens per session 5044f6593004
- 14d ago Changed · -4 lines scan A → B 4d69eb0d03e0
- 15d ago Changed · +2 lines · +5 tokens per session c0edcf004358
- 28d ago Changed · +2 lines de77a382020b
- 29d ago Changed 5a64fd273d12
- 1mo ago Changed · +15 lines 8a4d3df37f8d
- 1mo ago First seen · 161 lines · 61 tokens per session scan A ec9e170780a9
malloy-materialization is a skill published in the GitHub repository malloydata/publisher (118 stars, last pushed today), licensed MIT. It adds 92 tokens to every session and 3,711 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (strips warnings and disclaimers). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
developing-with-streamlit
Use for ALL Streamlit tasks: creating, editing, debugging, beautifying, styling, theming, optimizing, or deploying Streamlit apps. Also custom components, st.components.v2, HTML/JS/CSS work. Discovers and loads version-matched reference docs from the user's installed Streamlit (>=1.57). Triggers: streamlit, st.…
cnsplots
Create, revise, and troubleshoot publication-ready scientific plots in Python with cnsplots, including distribution, regression, heatmap, genomics, survival, set, flow, and multi-panel figures. Use when a user asks for cnsplots code, Cell/Nature/Science-style visualization, precise physical figure dimensions…
reimagine-it-extract
Emit the content signals reimagine-it reads from an HTML file — title, anchors, proper nouns, dates, numbers, emails, links, source hex colors, and the derived palette — as JSON without generating a redesign. Use when the user says /reimagine-it extract, "what does the engine see in this page", "extract the palette"…
regex
Write, test, and debug regular expressions for pattern matching, search, and text extraction across programming languages. Use when the user asks to match patterns in text, validate input formats (email, URL, IP, phone, date), extract data with capture groups, build search patterns with lookahead or lookbehind, or…
reusable-visualization
Build ONE reusable chart visualization component that receives its data and its settings from the host application instead of fetching them, and declares the fields and config options the host exposes to viewers. Use this whenever a single chart component is reused across many different queries rather than built for…
repository-writeback
Use when changing the dbt project through a pull request (editDbtProject) or managing those pull requests, offering to fix or extend the semantic layer, or following up a merged pull request.