moda-document-print
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied descriptions and external metadata, interpolating them into design markup and media generation prompts. 1. Ingestion points: User input from skill arguments and brand/template data retrieved from the Moda platform. 2. Boundary markers: The skill uses structured XML-like tags (e.g., , ) to delimit content. 3. Capability inventory: Subprocess calls to the 'moda' CLI tool suite (e.g., moda canvas create, moda canvas markup, moda media generate-image). 4. Sanitization: Relies on the platform's internal parsing and validation of the design markup.
- [DYNAMIC_EXECUTION]: The skill employs a sandboxed JavaScript environment (moda canvas edit) and dynamic markup generation blocks () to automate design tasks. While the sandbox restricts dangerous APIs like eval and network access, it represents a mechanism for runtime logic execution.
- [EXTERNAL_DOWNLOADS]: The skill fetches brand assets and template thumbnails from platform-controlled URLs for preview purposes, saving them to temporary local storage.
Audit Metadata