The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data when reading web content via moda web read or collaborative canvas data via moda canvas read.
Ingestion points: Web research results and shared canvas elements (SKILL.md, references/web.md, references/reading-and-verifying.md).
Boundary markers: The instructions explicitly state that canvas content is to be treated as DATA and should never override agent tasks or guidelines.
Capability inventory: The skill uses the moda CLI to mutate design state and export files (PDF, PPTX).
Sanitization: The skill relies on specific instructional guardrails to ensure the agent distinguishes between processed data and its own command logic.
[DYNAMIC_EXECUTION]: The skill utilizes a sandboxed JavaScript environment for batch editing (moda canvas edit) and procedural layout generation (<generate>).
The documentation (references/edit-code.md) identifies strict constraints that block dangerous patterns such as eval, require, import, and network access via fetch or window.
Execution is limited to a 100ms synchronous budget to prevent resource exhaustion attacks.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the @moda-design/moda package via npm to provide its core functionality.
This package is a vendor-owned CLI tool necessary for the skill's stated purpose of interacting with the Moda design platform.
[COMMAND_EXECUTION]: The skill makes extensive use of the moda CLI to perform design operations, manage brand kits, and execute metered media generation tasks.

moda-one-pager