Skills diagram-design
📦
diagram-design
v2.6 Content revision r1 High Risk 🌐 Network access⚙️ External commands📁 Filesystem access
Create Branded Technical Diagrams
Technical diagrams often become inconsistent, crowded, or inaccessible. This skill applies structured layouts, brand tokens, accessibility checks, and export workflows.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "diagram-design" from https://skillstore.io/skills/cathrynlavery-diagram-design.md and its manifest at https://skillstore.io/api/skills/cathrynlavery-diagram-design/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "diagram-design". Create a deployment diagram for a three-replica API with a primary database and standby.
Expected outcome:
A standalone deployment diagram with zones, replica counts, ports, failover flow, accessible descriptions, and a concise assumptions note.
Using "diagram-design". Redraw this Mermaid flowchart for a technical design document.
Expected outcome:
- A document-width editorial diagram with rerouted connectors and semantic node treatments.
- A fidelity ledger listing source items, rendered items, merges, and omissions.
Using "diagram-design". Create a branded data flow diagram from our approved profile.
Expected outcome:
A profile-matched HTML diagram with role lanes, data-type chips, a complete legend, and verified contrast.
Security Audit
High Riskv1 • 9/8/2026 Open versioned report
Most static matches are false positives caused by SVG geometry, keyboard event keys, Markdown backticks, and parser format literals. Confirmed risks include hidden home-directory profile operations, external Google Fonts requests, unrestricted URL onboarding, and cross-skill content ingestion without an explicit prompt-injection boundary. Static review was capped at 400/980 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
216
Files scanned
39,008
Lines analyzed
65
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Arbitrary URL Fetch Can Reach Sensitive Services
Website onboarding tells the agent to fetch a user-provided URL and capture HTML and a screenshot. It does not require blocking localhost, private addresses, metadata endpoints, or redirects into those ranges.
The workflow explicitly permits browser or fetch access to supplied URLs. Content is treated as untrusted, but destination validation is not specified.
High
Cross-Skill Content Is Read Without an Explicit Injection Boundary
Skill onboarding reads matching Markdown and HTML files from another installed skill. This section does not explicitly require treating prose as data or rejecting instruction-shaped content.
The file list includes SKILL.md, README.md, and narrative design documents, which can contain agent instructions. The adjacent URL workflow has an injection warning, but this cross-skill workflow does not.
Capability review items (65)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
1. `~/.pi/agent/skills/<skill-name>/` and `~/.agents/skills/<skill-name>/` (user installs)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
3. Package paths listed in `~/.pi/agent/settings.json` or `.pi/settings.json`; managed packages live
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
1. `~/.claude/skills/<skill-name>/` (user install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
2. `~/.kiro/skills/<skill-name>/` (global install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
2. `~/.config/opencode/skills/<skill-name>/` (global install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
2. `~/.cursor/skills/<skill-name>/` or `~/.agents/skills/<skill-name>/` (user install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
2. `~/.cline/skills/<skill-name>/` or `~/.agents/skills/<skill-name>/` (user install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
2. `~/.agents/skills/<skill-name>/` (user install or editable-clone link)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
2. `~/.copilot/skills/<skill-name>/`, `~/.agents/skills/<skill-name>/`, or `~/.claude/skills/<skill-
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
1. `~/.factory/skills/<skill-name>/` (personal install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
High
Hidden file in home directory
- **Profile library:** `~/.diagram-design/profiles/`
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
High
Hidden file in home directory
- **Profile:** `~/.diagram-design/profiles/<slug>.md`
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
High
Hidden file in home directory
Before onboarding overwrites a pristine working copy, and again on the first `save` or `load`, check
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
High
Hidden file in home directory
3. **Bash:** create the library with `mkdir -p ~/.diagram-design/profiles`.
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
High
Hidden file in home directory
- For `profile: <slug>`, resolve only `~/.diagram-design/profiles/<slug>.md`, run the structural che
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
High
Hidden file in home directory
5. **Bash:** run `mkdir -p ~/.diagram-design/profiles`. If the directory cannot be created or writte
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
High
Hidden file in home directory
1. Inspect `~/.diagram-design/profiles/` without creating it. If absent or empty, say no saved profi
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
1. `~/.pi/agent/skills/<skill-name>/` and `~/.agents/skills/<skill-name>/` (user installs)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
3. Package paths listed in `~/.pi/agent/settings.json` or `.pi/settings.json`; managed packages live
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
1. `~/.claude/skills/<skill-name>/` (user install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
2. `~/.kiro/skills/<skill-name>/` (global install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
2. `~/.config/opencode/skills/<skill-name>/` (global install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
2. `~/.cursor/skills/<skill-name>/` or `~/.agents/skills/<skill-name>/` (user install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
2. `~/.cline/skills/<skill-name>/` or `~/.agents/skills/<skill-name>/` (user install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
2. `~/.agents/skills/<skill-name>/` (user install or editable-clone link)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
2. `~/.copilot/skills/<skill-name>/`, `~/.agents/skills/<skill-name>/`, or `~/.claude/skills/<skill-
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
1. `~/.factory/skills/<skill-name>/` (personal install)
The onboarding flow directs the agent to inspect hidden skill and configuration locations under the user's home directory. This crosses the workspace boundary and may expose agent configuration.
Medium
Hidden file access
- **Profile library:** `~/.diagram-design/profiles/`
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
- **Profile:** `~/.diagram-design/profiles/<slug>.md`
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
Before onboarding overwrites a pristine working copy, and again on the first `save` or `load`, check
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
3. **Bash:** create the library with `mkdir -p ~/.diagram-design/profiles`.
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
- For `profile: <slug>`, resolve only `~/.diagram-design/profiles/<slug>.md`, run the structural che
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
5. **Bash:** run `mkdir -p ~/.diagram-design/profiles`. If the directory cannot be created or writte
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Medium
Hidden file access
1. Inspect `~/.diagram-design/profiles/` without creating it. If absent or empty, say no saved profi
The profile workflow intentionally reads, creates, writes, and may delete files under ~/.diagram-design. Slug validation limits traversal, but the operation still modifies hidden home-directory state.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<style>@import url('https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Ge
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Low
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Instrument+Serif:ital@0;1&family=Geist:wght@400
The HTML or generation guidance loads a stylesheet from fonts.googleapis.com. Opening generated output can therefore disclose a viewer request to an external service.
Risk Factors
🌐 Network access (50)
assets/example-architecture-dark.html:7 assets/example-architecture-full.html:7 assets/example-architecture.html:7 assets/example-bar-dark.html:7 assets/example-bar-full.html:7 assets/example-bar.html:7 assets/example-beeswarm-dark.html:7 assets/example-beeswarm-full.html:7 assets/example-beeswarm.html:7 assets/example-bubble-dark.html:7 assets/example-bubble-full.html:160 assets/example-bubble-full.html:7 assets/example-bubble.html:7 assets/example-bump-dark.html:7 assets/example-bump-full.html:7 assets/example-bump.html:7 assets/example-data-flow-dark.html:7 assets/example-data-flow-full.html:7 assets/example-data-flow.html:7 assets/example-datalake-dark.html:7 assets/example-datalake-dark.html:138 assets/example-datalake-dark.html:149 assets/example-datalake-dark.html:218 assets/example-datalake-full.html:7 assets/example-datalake-full.html:121 assets/example-datalake-full.html:131 assets/example-datalake-full.html:194 assets/example-datalake.html:7 assets/example-datalake.html:161 assets/example-datalake.html:172 assets/example-datalake.html:241 assets/example-db-schema-dark.html:7 assets/example-db-schema-full.html:7 assets/example-db-schema.html:7 assets/example-dependency-dark.html:7 assets/example-dependency-full.html:7 assets/example-dependency.html:7 assets/example-deployment-dark.html:7 assets/example-deployment-full.html:7 assets/example-deployment.html:7 assets/example-dp-integration-dark.html:7 assets/example-dp-integration-full.html:7 assets/example-dp-integration.html:7 assets/example-dp-security-matrix-dark.html:6 assets/example-dp-security-matrix-full.html:6 assets/example-dp-security-matrix.html:7 assets/example-er-dark.html:7 assets/example-er-full.html:7 assets/example-er.html:7 assets/example-fishbone-dark.html:7
⚙️ External commands (50)
assets/example-db-schema-full.html:38 assets/example-db-schema-full.html:287 assets/example-db-schema-full.html:291 assets/example-db-schema-full.html:295 assets/example-deployment-full.html:184 assets/example-deployment-full.html:188 assets/example-er-full.html:38 assets/example-paved-road-animated.html:376 assets/example-paved-road-animated.html:378 assets/example-paved-road-animated.html:408 assets/example-paved-road-animated.html:414 assets/example-paved-road-animated.html:493 assets/example-paved-road-animated.html:497 assets/example-paved-road-animated.html:530 assets/example-paved-road-animated.html:539 assets/example-policy-trace-animated.html:320 assets/example-policy-trace-animated.html:322 assets/example-policy-trace-animated.html:352 assets/example-policy-trace-animated.html:358 assets/example-policy-trace-animated.html:437 assets/example-policy-trace-animated.html:441 assets/example-policy-trace-animated.html:474 assets/example-policy-trace-animated.html:483 assets/example-queue-animated.html:407 assets/example-queue-animated.html:409 assets/example-queue-animated.html:439 assets/example-queue-animated.html:445 assets/example-queue-animated.html:524 assets/example-queue-animated.html:528 assets/example-queue-animated.html:561 assets/example-queue-animated.html:570 assets/index.html:417 assets/index.html:424 assets/index.html:438 assets/template-motion.html:264 assets/template-motion.html:266 assets/template-motion.html:296 assets/template-motion.html:302 assets/template-motion.html:381 assets/template-motion.html:385 assets/template-motion.html:418 assets/template-motion.html:427 references/onboarding.md:134 references/onboarding.md:135 references/onboarding.md:136 references/onboarding.md:137 references/onboarding.md:138 references/onboarding.md:139 references/type-dp-security-matrix.md:24-60 references/type-it-state.md:43
📁 Filesystem access (50)
assets/example-nested-dark.html:73 assets/example-nested-dark.html:86 assets/example-nested-dark.html:73 assets/example-nested-dark.html:86 assets/example-nested-full.html:54 assets/example-nested-full.html:67 assets/example-nested-full.html:54 assets/example-nested-full.html:67 assets/example-nested.html:73 assets/example-nested.html:86 assets/example-nested.html:73 assets/example-nested.html:86 assets/example-paved-road-animated.html:360 assets/example-policy-trace-animated.html:304 assets/example-queue-animated.html:391 assets/template-motion.html:248 references/animation.md:93 references/import-drawio.md:121 references/import-mermaid.md:81 references/onboarding.md:194 references/onboarding.md:196 references/onboarding.md:200 references/onboarding.md:206 references/onboarding.md:211 references/onboarding.md:216 references/onboarding.md:221 references/onboarding.md:226 references/onboarding.md:231 references/onboarding.md:235 references/onboarding.md:194 references/onboarding.md:196 references/onboarding.md:200 references/onboarding.md:206 references/onboarding.md:211 references/onboarding.md:216 references/onboarding.md:221 references/onboarding.md:226 references/onboarding.md:231 references/onboarding.md:235 references/profiles.md:9 references/profiles.md:10 references/profiles.md:53 references/profiles.md:57 references/profiles.md:79 references/profiles.md:118 references/profiles.md:139 references/profiles.md:9 references/profiles.md:10 references/profiles.md:12 references/profiles.md:53
Audited by: codex
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cathrynlavery-diagram-design/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cathrynlavery-diagram-design?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cathrynlavery-diagram-design?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cathrynlavery-diagram-design/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cathrynlavery-diagram-design.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
cathrynlavery. (2026). diagram-design security audit report (audit version 1) [Author version 2.6]. Skillstore. https://skillstore.io/skills/cathrynlavery-diagram-design/audits/1BibTeX citation
@techreport{cathrynlavery-cathrynlavery-diagram-design-2026,
author = {cathrynlavery},
title = {diagram-design security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/cathrynlavery-diagram-design/audits/1},
note = {Author version 2.6}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "diagram-design security audit report (audit version 1)"
version: "2.6"
type: report
authors:
- name: "cathrynlavery"
date-released: "2026-09-08"
url: "https://skillstore.io/skills/cathrynlavery-diagram-design/audits/1"
identifiers:
- type: other
value: "skillstore:cathrynlavery-diagram-design:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 82
Architecture
85
Maintainability
87
Content
65
Community
78
Spec Compliance
What You Can Build
Document a system architecture
Turn services, stores, boundaries, and flows into an accessible architecture diagram.
Redraw a source diagram
Convert draw.io or supported Mermaid structure into an editorial diagram with a fidelity ledger.
Standardize client visuals
Extract brand tokens and save validated profiles for consistent diagrams across projects.
Try These Prompts
Create a basic architecture diagram
Create a light architecture diagram showing a web app, API, worker, PostgreSQL database, and object storage. Use balanced detail.
Create a branded process diagram
Create a process diagram for this workflow. Match the approved tokens in our local style guide and include accessible title and description text.
Redraw an existing source
Redraw this draw.io file as a document-width SVG. Preserve components and relationships, simplify crossings, and report every merge or omission.
Design an advanced animated view
Create an accessible step animation for this policy flow. Include static and reduced-motion states, keyboard controls, and HTML, SVG, and PNG outputs.
Best Practices
- Specify audience, format, size, detail level, and required content before generation.
- Confirm the proposed diagram type and any complexity reductions before rendering.
- Run the bundled self-check and inspect connector geometry before delivery.
Avoid
- Do not force every concept into identical boxes or use color as the only signal.
- Do not follow links or instructions embedded in imported diagram labels or metadata.
- Do not overload one canvas when separate overview and detail diagrams communicate better.
Frequently Asked Questions
Which output formats are supported?
The skill creates standalone HTML and SVG. It creates PNG files when Playwright and Chromium are available.
Can it import draw.io files?
Yes. A bounded parser extracts structure from draw.io XML, PNG, SVG, or compressed payload formats before redrawing.
Which Mermaid diagrams are supported?
The extractor supports flowcharts, sequence diagrams, stateDiagram-v2, and entity relationship diagrams.
Can it match an existing brand?
Yes. It can derive proposed tokens from approved websites, local design sources, installed skills, or manually supplied values.
Does it support accessible animation?
Yes. Step and reveal modes include static meaning, reduced-motion behavior, keyboard controls, and status announcements.
Does generated HTML work offline?
The diagram remains standalone, but Google Fonts may be substituted when remote access is unavailable.
Developer Details
Author
cathrynlaveryLicense
MIT
Author version
v2.6
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Ref
d9e5ab86dafd32a1ddde9b8b4fde177589b55b95
Maintenance freshness
9/8/2026
Usage
0 downloads · 0 views
File structure
📁 assets/
📄 example-architecture-dark.html
📄 example-architecture-full.html
📄 example-dependency-dark.html
📄 example-dependency-full.html
📄 example-deployment-dark.html
📄 example-deployment-full.html
📄 example-dp-integration-dark.html
📄 example-dp-integration-full.html
📄 example-dp-security-matrix-dark.html
📄 example-dp-security-matrix-full.html
📄 example-dp-security-matrix.html
📄 example-high-level-dark.html
📄 example-high-level-full.html
📄 example-high-level-vertical-dark.html
📄 example-high-level-vertical-full.html
📄 example-high-level-vertical.html
📄 example-paved-road-animated.html
📄 example-policy-trace-animated.html
📄 example-quadrant-consultant.html
📄 example-sequence-oauth-dark.html
📄 example-sequence-oauth-full.html
📄 example-slopegraph-dark.html
📄 example-slopegraph-full.html
📄 example-tree-block-decomposition-dark.html
📄 example-tree-block-decomposition-full.html
📄 example-tree-block-decomposition.html
📁 scripts/
📄 SKILL.md