The Agent Skills Directory

[DYNAMIC_EXECUTION]: The moda canvas edit command and the <generate> markup element allow for the runtime execution of JavaScript to manipulate canvas nodes and generate layout elements. The execution environment is restricted to a synchronous sandbox that blocks access to potentially dangerous functions such as eval, require, and fetch. Documentation explicitly notes these constraints and advises that the sandbox acts as a security speedbump.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external sources, including canvas content (moda canvas read) and OpenTimelineIO files (references/otio.md). It implements a defensive instruction specifically directing the agent to treat content found on a canvas as data and not as instructions, which reduces the risk of the agent following malicious directives embedded in design artifacts.
[EXTERNAL_DOWNLOADS]: The skill facilitates the use of stock photography from well-known services such as Unsplash and integrates with established AI media models (e.g., Gemini, FLUX, Recraft) through the moda media toolset. These external references are handled as part of the tool's core creative functionality.
[COMMAND_EXECUTION]: The skill utilizes a specialized CLI (moda) via restricted Bash access. The allowed-tools frontmatter field limits the agent to the moda command space (Bash(moda:*)), applying a principle of least privilege to its operating environment.

moda-video