excalidraw-diagram — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited excalidraw-diagram (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate Excalidraw diagrams that are readable, code-aware, and visually consistent.
Do not freehand raw Excalidraw JSON unless the builder is unavailable. The default path is:
.excalidraw file with the builder scriptActivate when the user asks to create, explain with, visualize, or draw:
Examples:
references/codebase-discovery-prompt.md.Choose one of these view modes for each diagram request:
| User intent | View mode |
|---|---|
| "Show me the whole system" | overview |
| "What happens when a user logs in?" | focused-flow |
| "How does the auth service work internally?" | drill-down |
| "Document the payment system end to end" | scenario-pack |
| "Give me an overview and detail" | scenario-pack |
If the user does not specify a mode, infer it from context. Default to focused-flow for flow/path questions and overview for architecture/system questions.
These controls shape what the diagram includes and how it is presented. Set them in the shared model when building the spec.
| Control | Values | Default | Purpose |
|---|---|---|---|
detail_level | minimal, standard, detailed | standard | How much metadata to surface (descriptions, technology, evidence) |
audience | technical, executive, mixed | technical | Influences label verbosity and abstraction level |
scope_filter | entity ids or group names | all | Limit views to a subset of the model |
max_nodes | integer | none | Advisory node budget per view; triggers auto-split when exceeded |
max_nodes (or ~15 nodes when unset), split into overview + detail artifacts automatically.{date}-{topic}-{shortid} so multiple runs on the same day do not overwrite each other.Read references/diagram-quality-bar.md before choosing the diagram kind.
Use a C4-inspired level within each view:
dynamic for request paths, runtime flows, and "what happens when" explanationscontainer for service/application compositioncomponent for internals of a specific service/containercontext for high-level system boundariesarchitecture for broad layered overviews that do not fit neatly into one C4 leveldeployment for infrastructure and deployment topologydata-flow for data or event movement through the systemtrust-boundary for security zones and trust perimetersdependency-map for static service or package dependenciesFor overview views using layout: layers:
overview_style: core-with-sides when the diagram mixes internal layers with external systems or messagingpure-layers when the user explicitly wants a stacked tier diagramIf the user asks for multiple levels at once, use scenario-pack mode to generate the higher-level overview first plus detail views.
Read these before writing the spec:
references/diagram-quality-bar.mdreferences/diagram-spec.mdreferences/color-palette.mdUse these as examples when helpful:
references/examples/enhanced-auth-flow.spec.json — legacy single-view samplereferences/examples/multi-view-auth.spec.json — multi-view model samplereferences/examples/overview-example.spec.json — overview view modereferences/examples/focused-flow-example.spec.json — focused-flow view modereferences/examples/drill-down-example.spec.json — drill-down view modereferences/examples/scenario-pack-example.spec.json — scenario-pack with evidence metadatareferences/examples/simple-flow.excalidrawreferences/examples/architecture.excalidrawDetermine the view mode from the user's intent (see View Modes above). Set scope controls:
detail_level and audience based on context.max_nodes if the system is large or the user wants a focused view.scope_filter if the user names specific services or phases.scenario-pack, plan which views to include before writing the spec.Build one semantic model that captures all entities and relationships relevant to the request. This model is the single source of truth — all views derive from it.
The model must include:
title — system or project titlemodel.entities — all components with ids, labels, roles, and groupsmodel.relationships — all connections with labels and kindsdetail_level, audience, scope_filter, max_nodes as neededWhen discovery was performed, include evidence metadata on entities and relationships:
evidence_source: code, inferred, or user-specifiedconfidence: high, medium, or lowowner, boundary, runtime when knownAdd one or more views to the views array. Each view selects from the shared model.
Each view must include:
view_id — unique identifier for artifact namingview_mode — overview, focused-flow, drill-down, or scenario-packdiagram_kind — the abstraction levellayout and direction for flow diagramsoverview_style for layered overview/container/context views when side columns help readabilitygroupsentity_ids — subset of model entities to include (null means all)For single-view requests, you may use the legacy single-view format (flat nodes/edges without model/views). The builder supports both.
Quality rules:
node_type, technology, and short description fields when they help explain the flow.sequence on the main interactions in dynamic diagrams.shape: "decision" only for meaningful branches.Create:
mkdir -p docs/diagrams/specsSave the spec to:
docs/diagrams/specs/<date>-<topic>-<shortid>.diagram.jsonRun:
python <skill-dir>/references/build_excalidraw_diagram.py <spec-file> --output docs/diagrams/<date>-<topic>-<shortid>.excalidrawThe builder handles layout, containers, legends, node sizing, and arrow label placement.
Run:
python <skill-dir>/references/validate_excalidraw.py <diagram-file>If validation fails, fix the spec first and rebuild. Do not hand-edit raw JSON unless the problem is obviously builder-specific.
Run:
python <skill-dir>/references/render_excalidraw.py <diagram-file>If Playwright or browser rendering is unavailable:
.excalidraw fileCheck the preview for:
If the diagram is weak, edit the spec and rebuild. Prefer spec changes over raw JSON tweaks.
Report:
.excalidraw path(s) — list all artifacts when multiple views were generatedIf the discovered flow is too large for one readable diagram:
scenario-pack mode to emit an overview plus detail views.max_nodes in the model to trigger auto-split.Artifact naming for multi-view output:
{output_stem}-{view_id}.excalidraw for each view--output path directlyIterate on the spec at most 2 times unless the user asks for more refinement.
Only generate raw Excalidraw JSON directly if the builder script is broken or unavailable. If that happens, say so.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.