The Agent Skills Directory

[SAFE]: The skill provides a clear interface for interacting with the 'Moda' design platform via the moda CLI tool. The instructions are consistent with its stated purpose of image generation and transformation.
[DYNAMIC_EXECUTION]: The skill documentation (references/edit-code.md and references/markup.md) describes the use of a JavaScript sandbox for canvas edits and dynamic markup generation (<generate> tag). These features include explicit security constraints, such as blocking fetch, eval, require, and process, and enforcing execution time limits (100ms) and code size limits (16,384 characters).
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided text for image generation and chart data. While this presents a potential injection surface (e.g., embedding instructions in data), the documentation details sanitization procedures for HTML content (stripping disallowed tags) and the limitations of the JavaScript sandbox to mitigate these risks. All processed content traces back to intended design tasks.
[DATA_EXPOSURE]: The skill uses platform-specific tools (moda file upload/download) for asset management. No evidence of unauthorized access to sensitive system files, environment variables, or credential harvesting was found. Operations like moda media fetch-logo are documented as safe, free utility functions.

moda-image