The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill makes extensive use of the moda canvas edit tool, which executes dynamically generated JavaScript code in a sandboxed environment to perform batch mutations on design nodes. While this is a form of dynamic execution, the skill documentation in references/edit-code.md explicitly details the security constraints of this sandbox (e.g., no eval, no fetch, no require, 100ms timeout) to mitigate risk.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external content, including web page data retrieved via moda web read and user-uploaded files (PDF, DOCX, XLSX). Because this content is used to ground the generation of design layouts, text content, and executable scripts, there is an inherent vulnerability to indirect prompt injection where malicious instructions embedded in the source data could attempt to influence the agent's design decisions or tool usage.

moda-document