Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed draw.io diagram generator that creates local diagram files and exports, with no evidence of hidden or malicious behavior.
Before installing, be aware that the skill creates diagram files and image exports locally and may help place finalized files in a shared or cloud destination. Confirm the output path and sharing destination when diagrams contain private architecture, database, or workflow details.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- CLASS: Address -->
<mxCell id="10" value="Address"
style="swimlane;fontStyle=1;align=center;startSize=30;fontSize=14;fillColor=#dae8fc;strokeColor=#6c8ebf;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
vertex="1" parent="10">
<mxGeometry y="130" width="220" height="10" as="geometry"/>
</mxCell>
<!-- Methods -->
<mxCell id="13" value="-validate()
+outputAsLabel()"
style="text;strokeColor=none;fillColor=none;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;fontSize=12;"
vertex="1" parent="10">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry y="60" width="220" height="10" as="geometry"/>
</mxCell>
<!-- RELATIONSHIP: Address -> Person (association "lives at" 0..1) -->
<mxCell id="80" value="lives at"
style="edgeStyle=orthogonalEdgeStyle;endArrow=open;endFill=0;startArrow=none;fontSize=11;"
edge="1" parent="1" source="10" target="20">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry relative="1" as="geometry"/>
</mxCell>
<!-- RELATIONSHIP: Professor extends Person (inheritance - hollow triangle) -->
<mxCell id="83" value=""
style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=0;startArrow=none;fontSize=11;"
edge="1" parent="1" source="40" target="20">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- TABLE: Cliente | height = 30 + (5 × 30) = 180 -->
<mxCell id="10" value="Cliente"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- TABLE: Cliente | height = 30 + (5 x 30) = 180 -->
<mxCell id="10" value="Cliente"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- TABLE: Pedido | height = 30 + (3 × 30) = 120 -->
<mxCell id="30" value="Pedido"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- TABLE: Pedido | height = 30 + (3 x 30) = 120 -->
<mxCell id="30" value="Pedido"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- RELATIONSHIP: Cliente 1 to N Pedido -->
<!-- source=FK row of Pedido, target=PK row of Cliente -->
<mxCell id="90" value=""
style="edgeStyle=entityRelationEdgeStyle;endArrow=ERmandOne;startArrow=ERzeroToMany;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=11;"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="305" y="490" width="120" height="50" as="geometry"/>
</mxCell>
<!-- Connections -->
<mxCell id="20" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="10" target="11"><mxGeometry relative="1" as="geometry"/></mxCell>
<mxCell id="21" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="11" target="12"><mxGeometry relative="1" as="geometry"/></mxCell>
<mxCell id="22" value="Yes" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;fontSize=11;" edge="1" parent="1" source="12" target="13"><mxGeometry relative="1" as="geometry"/></mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="680" y="30" width="530" height="40" as="geometry"/>
</mxCell>
<!-- STEP 1 -->
<mxCell id="s1" value="1. Step Title"
style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=11;fontStyle=1;align=left;
spacingLeft=12;spacingRight=12;spacingTop=10;spacingBottom=10;verticalAlign=top;"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="50" y="290" width="550" height="50" as="geometry"/>
</mxCell>
<!-- Step 1 → Step 2 arrow -->
<mxCell id="e_s1_s2" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="s1" target="s2">
<mxGeometry relative="1" as="geometry"/>
</mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry relative="1" as="geometry"/>
</mxCell>
<!-- Sub-items chain: b1 → b2 → b3 → b4 -->
<mxCell id="e_b1_b2" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="b1" target="b2">
<mxGeometry relative="1" as="geometry"/>
</mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- Frontend service -->
<mxCell id="10" value="React Frontend"
style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;fontStyle=1;
spacingLeft=12;spacingRight=12;spacingTop=10;spacingBottom=10;"
The README says to invoke the skill whenever a user requests a diagram, flowchart, ERD, architecture visualization, or asks to edit an existing .drawio file, which is a broad natural-language trigger surface. It does not provide exclusions, negative examples, or narrower context constraints, so routine conversation about diagrams could be interpreted as an activation condition.
The phrase "visualize this process" is ambiguous and common in normal conversation, so it can activate the skill when the user may only want an explanation rather than a generated diagram. In this skill, accidental activation is more concerning because the workflow mandates file creation, image export, and iterative processing, expanding the side effects of a mistaken trigger.
The phrase "visualize this process" is ambiguous and common in normal conversation, so it can activate the skill when the user may only want an explanation rather than a generated diagram. In this skill, accidental activation is more concerning because the workflow mandates file creation, image export, and iterative processing, expanding the side effects of a mistaken trigger.
The skill instructs the agent to create a local directory and save generated artifacts, but it does not warn that files will be written to local storage or explain retention and overwrite behavior. This can lead to unexpected persistence of user data, especially if the diagram content contains sensitive system architecture, database, or workflow details.
The skill references Drive delivery and custom output paths without any accompanying privacy, destination-validation, or data-handling guidance. That creates a risk of sending generated diagrams containing sensitive information to unintended locations or to external storage without informed user consent.
This markdown file includes natural-language examples such as "Cliente", "Pedido", and "Nombre" in a way that models the expected output format. Because the document does not say the skill is Spanish-specific or that users may choose another language, it can be read as prescribing a specific language convention without opt-in.
No suspicious patterns detected.