Is drawio safe to install?

SaferSkills independently audited drawio (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/drawio/SKILL.md · 1 file

skills/drawio/SKILL.md2.4 KB · Markdown

name: drawio

description: Apply when creating or reviewing architecture diagrams, Mermaid diagrams, or draw.io files.

license: MIT

version: 1.0.0

tokens_target: 1300

triggers:

- architecture diagram

- mermaid diagram

- drawio file

loads_after: []

supersedes: []

Sub-Skill: Diagrams (draw.io / Mermaid)

Purpose: Ensure diagrams are version-controlled as source, rendered consistently, and kept in sync with the system they describe.

Rules

Source Control

Commit source, not just exports. Always commit diagram source files (.drawio, .mmd, .puml) alongside or instead of rendered image exports. Reference: ERR-2026-027
No binary-only diagrams. Never commit only a PNG or SVG export without the editable source; reviewers cannot diff or modify a raster image.
One source file per diagram. Use a single canonical source file per diagram; avoid duplicating the same diagram in multiple formats.

Format Selection

Prefer diagram-as-code. Prefer Mermaid or PlantUML over draw.io XML when the diagram fits a supported diagram type; text diffs are reviewable.
Match diagram type to content. Use sequenceDiagram for request flows, flowchart for decision logic, C4Context/C4Container for architecture, erDiagram for data models.
Set layout direction explicitly. Always declare layout direction (LR, TD) in Mermaid flowcharts; never rely on the default, which varies by renderer.

Rendering Pipeline

Document the render command. Always include the render command or CI step in the repo README or Makefile so any contributor can regenerate exports.
Regenerate exports in CI. Ensure CI regenerates diagram exports from source and fails if the committed export differs from the generated one.
Pin renderer version. Always pin the Mermaid CLI or draw.io CLI version in CI to prevent silent rendering changes across upgrades.

Quality & Consistency

Use consistent node naming. Always use the same label for the same system component across all diagrams in the repo; divergent names cause confusion.
Add alt text to exported images. Always add descriptive alt text to diagram images embedded in documentation for accessibility.
Review diagrams in PRs. Before merging, verify that any diagram change accurately reflects the system change described in the PR.

drawio— agent skill

Is drawio safe to install?

Sub-Skill: Diagrams (draw.io / Mermaid)

Rules

Source Control

Format Selection

Rendering Pipeline

Quality & Consistency

See also

Audit the pieces. Scan the whole. Decide.