The Agent Skills Directory

[SAFE]: The skill is entirely focused on providing documentation and workflows for the 'moda' CLI toolset. All described operations (canvas creation, brand kit management, media generation) are conducted through these platform-specific tools.
[INDIRECT_PROMPT_INJECTION]: The skill includes a 'Data-not-instructions' rule in references/reading-and-verifying.md, explicitly instructing the agent to treat canvas content as data and to ignore any directives embedded within text authored by other agents or users. This is a proactive safety measure against indirect injection.
[DYNAMIC_EXECUTION]: The skill documents the use of a sandboxed JavaScript editor (moda canvas edit) and a markup-based generation block (<generate>). These environments are described as having strict execution limits (100ms synchronous budget, 16KB code cap) and blocking dangerous globals like eval, require, and fetch. These are design-time automation features of the platform rather than security vulnerabilities.
[EXTERNAL_DOWNLOADS]: The documentation mentions using curl to view brand assets via signed URLs generated by the moda brand show command. These downloads are facilitated by the vendor's own tooling for the purpose of visual verification of brand assets.

moda-mockup