The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes the moda canvas edit command to execute JavaScript for batch mutations of canvas nodes. As described in references/edit-code.md, this execution occurs within a restricted sandbox that explicitly blocks dangerous APIs such as eval, Function, fetch, import, and require. While this is a dynamic execution surface, the implemented constraints mitigate risks of arbitrary code execution or network exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from external sources—including user-uploaded files (moda file show), brand kits (moda brand show), and external websites (moda web read). This data is subsequently interpolated into canvas markup (moda canvas markup) and edit scripts. The instructions lack explicit boundary markers or sanitization steps for this external content, relying on the agent's internal safety filters.

moda-social-tiktok