The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it is designed to ingest and process data from external websites and brand metadata.\n
Ingestion points: External URLs (via moda brand create --url), brand kit configurations (via moda brand show), and user-supplied design briefs.\n
Boundary markers: There are no specific instructions or delimiters defined to isolate or sanitize instructions that might be embedded in the external content being processed.\n
Capability inventory: The skill utilizes a powerful toolset capable of creating and modifying canvases (moda canvas create, moda canvas markup), executing dynamic scripts (moda canvas edit), and generating media (moda media generate-image).\n
Sanitization: The instructions do not specify any validation or filtering mechanisms for data retrieved from external sources before it is used to influence the agent's design decisions.\n- [DYNAMIC_EXECUTION]: The skill relies on dynamic JavaScript execution to perform complex canvas manipulations and layout logic.\n
Evidence: The references/edit-code.md and references/gotchas.md files describe a batch editor and markup tags (<generate>) that execute JavaScript code within a sandboxed environment on the tool host. This sandbox is designed with restricted global APIs and execution timeouts to mitigate risk.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of external assets required for the design process.\n
Evidence: In references/brand.md, the agent is instructed to use curl to download brand logos from signed preview URLs provided by the platform's brand management system. These downloads are directed to temporary local storage for visual inspection by the agent.

moda-deck-theme