drawio-architecture

• Outcome: Review
• Latest audit: Sep 20, 2026 · 4:11 PM UTC
• Version: 1.0.7

Overview

The skill is a coherent draw.io diagram helper, but its setup script can persist an unpinned remote MCP server into agent configuration files.

Install only if you are comfortable with a draw.io MCP integration changing agent configuration. Prefer manual setup with an exact @drawio/mcp version, review the config diff first, avoid the bundled setup helper unless it is fixed to pin versions, and do not use the hosted endpoint for sensitive architecture diagrams.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description focuses on generating or editing diagrams, but the supplied code does not generate or edit diagram content in that sense. Its primary functions are validation, scoring, and file repair. In particular, the PNG IEND repair capability is materially different from diagram generation/editing and involves binary file modification not suggested by the description. While XML linting is related to draw.io artifacts, the overall behavior is better characterized as a validation/repair tool than a diagram authoring skill.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 93% confidence

Finding

The skill instructs editing MCP client configuration files such as '.vscode/mcp.json' and '~/.cursor/mcp.json', which are trusted execution/configuration surfaces. A skill that can influence these files can persist tool access, redirect MCP endpoints, or insert malicious server definitions, making this especially sensitive because it touches long-lived agent trust boundaries rather than just project-local artifacts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

Replace `<VERSION>` with the latest stable release verified on [npm](https://www.npmjs.com/package/@drawio/mcp). Do not run bare `npx -y @drawio/mcp` because it resolves to the latest remote version at runtime.

Add it to your client's MCP config under `mcpServers.drawio`. For the concrete JSON block per platform plus self-hosting, see **`references/mcp-config.md`** (Claude Desktop, Claude Code, VS Code `.vscode/mcp.json`, Cursor `~/.cursor/mcp.json`, OpenCode, Windsurf, and the `DRAWIO_BASE_URL` env for self-hosted instances).

There is also a **hosted** alternative (`https://mcp.draw.io/mcp`) that renders diagrams *inline* via the MCP Apps protocol (Claude.ai, VS Code, Cursor) — no install, but it is a *different* server type than the stdio one above and sends your diagram XML to the draw.io vendor's servers. Only use it for non-sensitive diagrams and when you trust the vendor endpoint.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

Core shapes (vertex)

xml

<!-- Rounded rectangle — services, modules -->
<mxCell id="2" value="Label" style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;" vertex="1" parent="1">
  <mxGeometry x="100" y="100" width="140" height="60" as="geometry"/>
</mxCell>

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/mcp-config.md (reported line 18)May include surrounding context.

md

| Target (`--target`) | Agent / IDE | Config file | JSON key |
|---------------------|-------------|-------------|----------|
| `claude-desktop` | Claude Desktop | `~/Library/Application Support/Claude/claude_desktop_config.json` (mac) / `%APPDATA%\Claude\...` (win) / `~/.config/Claude/...` (linux) | `mcpServers` |
| `claude-code` | Claude Code | `~/.claude/settings.json` (or `claude mcp add drawio -- npx -y @drawio/mcp@<VERSION>`) | `mcpServers` |
| `vscode` | VS Code / GitHub Copilot | `.vscode/mcp.json` (workspace) or `~/.config/Code/User/mcp.json` (global) | `servers` |
| `cursor` | Cursor | `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project) | `mcpServers` |
| `opencode` | OpenCode | `~/.config/opencode/opencode.json` (or `opencode mcp add drawio -- npx -y @drawio/mcp@<VERSION>`) | `mcpServers` |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/mcp-config.md (reported line 26)May include surrounding context.

md

| `devin` | Devin Desktop | `~/.devin/mcp.json` (linux) — also via Devin app/UI Integrations | `mcpServers` |
| `devin-cli` | Devin CLI | `~/.config/devin/mcp.json` — also via Devin app/UI | `mcpServers` |
| `agy` | AGY (Antigravity CLI) | `~/.gemini/antigravity-cli/mcp.json` — also via Antigravity UI | `mcpServers` |
| `antigravity` | Antigravity IDE | `~/.gemini/settings.json` (reuses Gemini CLI) | `mcpServers` |
| `gemini` | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` |

The universal block for **every** stdio client (Claude, Cursor, OpenCode, Windsurf, Devin, AGY, Antigravity, Gemini, …):

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/mcp-config.md (reported line 27)May include surrounding context.

md

| `devin` | Devin Desktop | `~/.devin/mcp.json` (linux) — also via Devin app/UI Integrations | `mcpServers` |
| `devin-cli` | Devin CLI | `~/.config/devin/mcp.json` — also via Devin app/UI | `mcpServers` |
| `agy` | AGY (Antigravity CLI) | `~/.gemini/antigravity-cli/mcp.json` — also via Antigravity UI | `mcpServers` |
| `antigravity` | Antigravity IDE | `~/.gemini/settings.json` (reuses Gemini CLI) | `mcpServers` |
| `gemini` | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` |

The universal block for **every** stdio client (Claude, Cursor, OpenCode, Windsurf, Devin, AGY, Antigravity, Gemini, …):

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/mcp-config.md (reported line 256)May include surrounding context.

md

| `devin` | Devin Desktop | `~/.devin/mcp.json` (linux) — also via Devin app/UI Integrations | `mcpServers` |
| `devin-cli` | Devin CLI | `~/.config/devin/mcp.json` — also via Devin app/UI | `mcpServers` |
| `agy` | AGY (Antigravity CLI) | `~/.gemini/antigravity-cli/mcp.json` — also via Antigravity UI | `mcpServers` |
| `antigravity` | Antigravity IDE | `~/.gemini/settings.json` (reuses Gemini CLI) | `mcpServers` |
| `gemini` | Gemini CLI | `~/.gemini/settings.json` | `mcpServers` |

The universal block for **every** stdio client (Claude, Cursor, OpenCode, Windsurf, Devin, AGY, Antigravity, Gemini, …):

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup_drawio_mcp.py (reported line 49)May include surrounding context.

python

},
        "claude-code": {
            "key": "mcpServers",
            "paths": {"*": f"{h}/.claude/settings.json"},
        },
        "vscode": {
            "key": "servers",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup_drawio_mcp.py (reported line 94)May include surrounding context.

python

"antigravity": {
            "key": "mcpServers",
            "note": "Antigravity IDE reuses the Gemini CLI settings file.",
            "paths": {"*": f"{h}/.gemini/settings.json"},
        },
        "gemini": {
            "key": "mcpServers",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup_drawio_mcp.py (reported line 98)May include surrounding context.

python

"antigravity": {
            "key": "mcpServers",
            "note": "Antigravity IDE reuses the Gemini CLI settings file.",
            "paths": {"*": f"{h}/.gemini/settings.json"},
        },
        "gemini": {
            "key": "mcpServers",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of environment variables, local file reads/writes, and networked MCP/npm operations, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the blast radius because an agent may grant or assume broader capabilities than necessary when following the skill, especially around config file modification and remote package execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill states the server is distributed as 'npx @drawio/mcp' before later clarifying that a pinned version should be used. Even though later guidance is safer, leading with an unpinned install pattern in setup documentation can still cause users or agents to execute remote code without version pinning, enabling supply-chain compromise or unexpected code changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation recommends invoking the MCP server via npx @drawio/mcp without pinning an exact package version. This creates a supply-chain risk: future package updates, dependency compromise, or typosquatting-style replacement could cause an agent or user to execute unexpected code when following the skill instructions. In this skill context, that risk is more significant because the file explicitly instructs agents to use the MCP toolchain, increasing the chance the unpinned command will be copied and run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation instructs users to run npx @drawio/mcp without pinning a specific package version. This creates a supply-chain risk because future package updates, account compromise, or malicious publishes could cause users to execute unreviewed code at install/runtime. In this skill context, the risk is somewhat elevated because the file explicitly recommends using the MCP tools, increasing the likelihood that operators will execute the unpinned package.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.