Security audit
Security checks for vulnerabilities and agentic risk
This skill is a draw.io diagram helper that writes local diagram files and exports images, with no evidence of hidden malicious behavior.
Install this if you want an agent to create draw.io files and exported images locally. Be aware it may run the local draw.io/xvfb-run export tools and create files under a diagrams folder; review the output path when working in sensitive repositories or shared folders.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- CLASS: Address -->
<mxCell id="10" value="Address"
style="swimlane;fontStyle=1;align=center;startSize=30;fontSize=14;fillColor=#dae8fc;strokeColor=#6c8ebf;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
vertex="1" parent="10">
<mxGeometry y="130" width="220" height="10" as="geometry"/>
</mxCell>
<!-- Methods -->
<mxCell id="13" value="-validate()
+outputAsLabel()"
style="text;strokeColor=none;fillColor=none;align=left;verticalAlign=top;spacingLeft=4;spacingRight=4;overflow=hidden;rotatable=0;fontSize=12;"
vertex="1" parent="10">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry y="60" width="220" height="10" as="geometry"/>
</mxCell>
<!-- RELATIONSHIP: Address -> Person (association "lives at" 0..1) -->
<mxCell id="80" value="lives at"
style="edgeStyle=orthogonalEdgeStyle;endArrow=open;endFill=0;startArrow=none;fontSize=11;"
edge="1" parent="1" source="10" target="20">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry relative="1" as="geometry"/>
</mxCell>
<!-- RELATIONSHIP: Professor extends Person (inheritance - hollow triangle) -->
<mxCell id="83" value=""
style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=0;startArrow=none;fontSize=11;"
edge="1" parent="1" source="40" target="20">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- TABLE: Cliente | height = 30 + (5 × 30) = 180 -->
<mxCell id="10" value="Cliente"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- TABLE: Cliente | height = 30 + (5 x 30) = 180 -->
<mxCell id="10" value="Cliente"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#dae8fc;strokeColor=#6c8ebf;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- TABLE: Pedido | height = 30 + (3 × 30) = 120 -->
<mxCell id="30" value="Pedido"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- TABLE: Pedido | height = 30 + (3 x 30) = 120 -->
<mxCell id="30" value="Pedido"
style="shape=table;startSize=30;container=1;collapsible=0;childLayout=tableLayout;fixedRows=1;rowLines=0;fontStyle=1;fontSize=14;align=center;fillColor=#e1d5e7;strokeColor=#9673a6;fontColor=#000000;swimlaneLine=1;"
vertex="1" parent="1">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="40" width="180" height="30" as="geometry"><mxRectangle width="180" height="30" as="alternateBounds"/></mxGeometry>
</mxCell>
<!-- RELATIONSHIP: Cliente 1 to N Pedido -->
<!-- source=FK row of Pedido, target=PK row of Cliente -->
<mxCell id="90" value=""
style="edgeStyle=entityRelationEdgeStyle;endArrow=ERmandOne;startArrow=ERzeroToMany;exitX=0;exitY=0.5;exitDx=0;exitDy=0;entryX=0;entryY=0.5;entryDx=0;entryDy=0;fontSize=11;"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="305" y="490" width="120" height="50" as="geometry"/>
</mxCell>
<!-- Connections -->
<mxCell id="20" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="10" target="11"><mxGeometry relative="1" as="geometry"/></mxCell>
<mxCell id="21" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="11" target="12"><mxGeometry relative="1" as="geometry"/></mxCell>
<mxCell id="22" value="Yes" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;fontSize=11;" edge="1" parent="1" source="12" target="13"><mxGeometry relative="1" as="geometry"/></mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="680" y="30" width="530" height="40" as="geometry"/>
</mxCell>
<!-- STEP 1 -->
<mxCell id="s1" value="1. Step Title"
style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=11;fontStyle=1;align=left;
spacingLeft=12;spacingRight=12;spacingTop=10;spacingBottom=10;verticalAlign=top;"
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry x="50" y="290" width="550" height="50" as="geometry"/>
</mxCell>
<!-- Step 1 → Step 2 arrow -->
<mxCell id="e_s1_s2" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="s1" target="s2">
<mxGeometry relative="1" as="geometry"/>
</mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxGeometry relative="1" as="geometry"/>
</mxCell>
<!-- Sub-items chain: b1 → b2 → b3 → b4 -->
<mxCell id="e_b1_b2" value="" style="edgeStyle=orthogonalEdgeStyle;endArrow=block;endFill=1;" edge="1" parent="1" source="b1" target="b2">
<mxGeometry relative="1" as="geometry"/>
</mxCell>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<mxCell id="0"/>
<mxCell id="1" parent="0"/>
<!-- Frontend service -->
<mxCell id="10" value="React Frontend"
style="rounded=1;whiteSpace=wrap;html=1;fillColor=#dae8fc;strokeColor=#6c8ebf;fontSize=14;fontStyle=1;
spacingLeft=12;spacingRight=12;spacingTop=10;spacingBottom=10;"
The README says to invoke the skill whenever a user requests a diagram, flowchart, ERD, architecture visualization, or asks to edit an existing .drawio file. While domain-related, this activation rule is still broad and does not define boundaries, exclusions, or negative examples, which can cause unintended invocation for casual or partial mentions of those terms.
The top-level description says to use the skill when the user requests 'any diagram or visualization,' which is broader than the actual draw.io-specific scope and can cause the skill to activate for ambiguous requests. Over-broad activation increases the chance an agent will enter a file-writing and command-execution workflow in contexts where the user did not clearly ask for diagram generation or local artifact creation.
The trigger list includes generic phrases such as 'diagram' and 'visualize this process,' which can collide with ordinary conversation and cause unintended skill invocation. In this skill, accidental invocation matters because the workflow includes creating local files and running export commands, expanding the blast radius of a simple routing mistake.
The manifest describes a skill for generating draw.io diagrams with visual QA, but the documented workflow explicitly instructs running local CLI commands including the draw.io binary and xvfb-run. Spawning subprocesses is not clearly justified by the high-level purpose as stated in the manifest, which presents the skill as a diagram-generation skill rather than a local command-execution tool.
The skill directs the agent to create local directories/files and invoke draw.io export commands, but it does not require notifying the user or obtaining confirmation before those side effects occur. Hidden side effects reduce user control and can lead to unexpected filesystem changes or subprocess execution, especially if the skill is triggered too broadly.
This markdown file contains natural-language examples such as table names and column labels in Spanish (for example, "Cliente", "Pedido", and "Nombre") within the skill guidance and template. Because the file does not indicate that the skill is Spanish-specific or give the user a language/locale option, it may impose a locale implicitly.
No suspicious patterns detected.