Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent draw.io diagram generator that creates and exports diagram files, with no evidence of hidden malicious behavior.
Install this if you want an agent to create draw.io diagram files and rendered exports. Review requested output paths before use, especially custom destinations or shared-drive workflows, because the skill is designed to create, move, and export diagram files.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- CLASS: Address -->
<mxCell id="10" value="Address"
style="swimlane;fontStyle=1;align=center;startSize=30;fontSize=14;fillColor=#dae8fc;strokeColor=#6c8ebf;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
vertex="1" parent="10">
<mxGeometry y="130" width="220" height="10" as="geometry"/>
</mxCell>
<!-- Methods -->
<mxCell id="13" value="-validate()
+outputAsLabel()"
style="text;strokeColor=none;fillColor=none;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;fontSize=12;"
vertex="1" parent="10">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry y="60" width="220" height="10" as="geometry"/>
</mxCell>
<!-- RELATIONSHIP: Address -> Person (association "lives at" 0..1) -->
<mxCell id="80" value="lives at"
style="edgeStyle=orthogonalEdgeStyle;endArrow=open;endFill=0;startArrow=none;fontSize=11;"
edge="1" parent="1" source="10" target="20">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry relative="1" as="geometry"/>
</mxCell>
<!-- RELATIONSHIP: Professor extends Person (inheritance - hollow triangle) -->
<mxCell id="83" value=""
style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=0;startArrow=none;fontSize=11;"
edge="1" parent="1" source="40" target="20">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- TABLE: Cliente | height = 30 + (5 × 30) = 180 -->
<mxCell id="10" value="Cliente"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- TABLE: Cliente | height = 30 + (5 x 30) = 180 -->
<mxCell id="10" value="Cliente"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- TABLE: Pedido | height = 30 + (3 × 30) = 120 -->
<mxCell id="30" value="Pedido"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- TABLE: Pedido | height = 30 + (3 x 30) = 120 -->
<mxCell id="30" value="Pedido"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- RELATIONSHIP: Cliente 1 to N Pedido -->
<!-- source=FK row of Pedido, target=PK row of Cliente -->
<mxCell id="90" value=""
style="edgeStyle=entityRelationEdgeStyle;endArrow=ERmandOne;startArrow=ERzeroToMany;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=11;"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="305" y="490" width="120" height="50" as="geometry"/>
</mxCell>
<!-- Connections -->
<mxCell id="20" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="10" target="11"><mxGeometry relative="1" as="geometry"/></mxCell>
<mxCell id="21" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="11" target="12"><mxGeometry relative="1" as="geometry"/></mxCell>
<mxCell id="22" value="Yes" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;fontSize=11;" edge="1" parent="1" source="12" target="13"><mxGeometry relative="1" as="geometry"/></mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="680" y="30" width="530" height="40" as="geometry"/>
</mxCell>
<!-- STEP 1 -->
<mxCell id="s1" value="1. Step Title"
style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=11;fontStyle=1;align=left;
spacingLeft=12;spacingRight=12;spacingTop=10;spacingBottom=10;verticalAlign=top;"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="50" y="290" width="550" height="50" as="geometry"/>
</mxCell>
<!-- Step 1 → Step 2 arrow -->
<mxCell id="e_s1_s2" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="s1" target="s2">
<mxGeometry relative="1" as="geometry"/>
</mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry relative="1" as="geometry"/>
</mxCell>
<!-- Sub-items chain: b1 → b2 → b3 → b4 -->
<mxCell id="e_b1_b2" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="b1" target="b2">
<mxGeometry relative="1" as="geometry"/>
</mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- Frontend service -->
<mxCell id="10" value="React Frontend"
style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;fontStyle=1;
spacingLeft=12;spacingRight=12;spacingTop=10;spacingBottom=10;"
The README says to invoke the skill whenever a user requests a diagram, flowchart, ERD, architecture visualization, or asks to edit an existing .drawio file. This covers a wide range of common requests but does not define exclusions, constraints, or negative examples, making activation scope ambiguous and increasing the risk of unintended invocation.
The skill description uses broad invocation language such as handling 'any diagram, flowchart, or system visualization,' which can cause the agent to select this skill for loosely related requests without strong scope boundaries. Over-broad routing increases the chance of unintended file creation, tool execution, and processing of user content in contexts where a simpler or non-file-writing response would be safer.
The trigger list includes generic phrases like 'diagram,' 'flowchart,' and 'visualize this process' without requiring user confirmation that a draw.io workflow, file generation, or exports are desired. This can lead to unintended invocation of a skill that writes files and runs external tooling, expanding the action surface beyond what the user may have expected.
The workflow instructs the agent to create directories, write diagram files, export rendered outputs, and support custom output paths, but it does not require an explicit warning or confirmation before making filesystem changes. In practice, this can surprise users, overwrite existing files, or place artifacts in unintended locations, especially when combined with broad invocation criteria.
This markdown file includes natural-language example content such as "Cliente", "Pedido", and "Nombre" embedded in the guidance and XML template. Because the skill does not state that it is Spanish-specific or offer a user language/locale option, it may implicitly force a specific language in generated outputs.
No suspicious patterns detected.