The Agent Skills Directory

[COMMAND_EXECUTION]: The skill is configured with access to the moda CLI tool suite through the Bash(moda:*) allowed-tools configuration. This is the intended and restricted mechanism for the agent to interact with its host platform.
[DYNAMIC_EXECUTION]: The skill documents the use of a sandboxed JavaScript environment for batch editing canvas elements via the moda canvas edit command and the <generate> markup tag. The documentation explicitly details safety constraints, including a 100ms execution timeout, a 16KB code size limit, and the blocking of dangerous functions like eval, require, and fetch to prevent unauthorized code execution.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes user-authored canvas content. However, it incorporates explicit defensive instructions for the agent to treat all canvas text as data rather than instructions, and it provides specific guidance on ignoring directives embedded in canvas content.
[REMOTE_CODE_EXECUTION]: The skill utilizes official platform commands (moda media, moda web) to interact with remote AI models and research tools. These are legitimate, metered platform functions used for asset generation and are not indicative of unauthorized remote execution.

moda-video