drawio-skill Claude skill

Skill that turns natural language, Terraform, SQL, OpenAPI and other sources into editable draw.io diagrams, with incremental sync, drift detection and CI tests.

Our verdict Recommended

A genuinely deep diagramming skill with sync, drift tests and many export formats; it does require the draw.io desktop app for full functionality.

What drawio-skill does

drawio-skill generates and maintains .drawio architecture models rather than one-off pictures. It converts natural language descriptions, Terraform or Kubernetes manifests, SQL schemas, OpenAPI, AsyncAPI, Protobuf and GraphQL sources into diagrams, and also goes the other way: querying dependencies, simulating failure propagation, projecting multiple views from one model, and running architecture tests in CI that fail a build when the diagram and the real system drift apart. Incremental sync updates a diagram from new source code without discarding the layout you manually arranged. Other commands derasterize a whiteboard photo back into an editable model and export interactive HTML, PPTX or Mermaid walkthroughs. The single SKILL.md is about 9.7 KB, with 25 reference files and roughly 45 scripts handling layout (aiicons.py maps 321 AI/LLM brand logos to draw.io styles, autolayout.py wraps Graphviz), diagram IR manipulation, compression and a diagramctl CLI with an optional MCP server. It needs the draw.io desktop app (version 30 or newer recommended) for Mermaid conversion and ELK layout, and Graphviz is optional for layout.

Good for

  • Keeping architecture diagrams in sync with Terraform, K8s or API schemas
  • Teams who want diagram drift caught in CI
  • Converting a whiteboard photo into an editable diagram

Not for

  • Quick one-off sketches, where a simpler diagram skill is faster
  • Users without the draw.io desktop app installed

What's inside depth 4/5

One 9.7 KB SKILL.md with 25 reference files and about 45 scripts covering layout, sync, drift testing and multiple export formats, but no bundled test suite of its own.

Skills
1
Reference docs
25
Scripts
45
Tests / evals
0
Templates
0
Avg SKILL.md
9.5 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • draw.io desktop app (version 30+ recommended) for Mermaid conversion and ELK layout
  • Python 3 for the scripts
  • Graphviz, optional, for autolayout

How drawio-skill routes a request

The SKILL.md opens with a routing table, and the route decides which reference file the agent reads first. The main entrypoint is scripts/diagramctl.py, which handles generation, incremental sync, multi-view projection, queries, tests, reviews, failure analysis and publishing over a shared Diagram IR.

What you ask for What the skill does
A diagram from a description, with precise styling Reads references/diagram-types.md, then references/xml-authoring.md, and writes draw.io XML directly
A standard flowchart, mindmap, gantt or timeline with no special styling On draw.io 30 or newer, reads references/mermaid-authoring.md and converts Mermaid text into a native .drawio
A large graph (roughly 15+ nodes) Uses autolayout.py and reads references/autolayout.md before passing any --layout value
Code, Terraform, K8s, compose, SQL, OpenAPI, AsyncAPI or CI config Runs diagramctl.py build, guided by references/diagram-ir.md
A Protocol Buffers schema Uses protoimports.py or diagramctl.py build

For a prompt-driven diagram, the README describes this loop:

  1. Describe the system, for example: "Draw a C4 container diagram for a web app, an API service and a Postgres database."
  2. The skill plans the layout, writes the XML and exports a PNG.
  3. It checks its own PNG and fixes overlaps, clipped labels and stacked edges, running up to 2 rounds of fixes.
  4. You review the result and ask for changes. It accepts up to 5 rounds of feedback.

When the source changes later, diagramctl sync updates the nodes and relations that changed and keeps your tuned coordinates, styles and annotations. Removed nodes are not dropped silently. They stay reviewable by default.

Supported diagram types, sources and exports

The skill ships 11 diagram type presets: ERD, UML Class, Sequence, C4, Architecture, ML/Deep Learning, Flowchart, SysML, BPMN, Network Topology and Cross-Functional Swimlane. On draw.io 30 or newer, you can also write any of 28 standard Mermaid types (mindmap, gantt, timeline, journey, pie, sankey, kanban and others) and have the CLI turn them into a laid-out, editable .drawio.

Supported source inputs:

  • Import graphs for Python, JS/TS, Go and Rust, plus Python class hierarchies, laid out with Graphviz and grouped into nested module containers
  • Terraform, Kubernetes and docker-compose configs rendered with official AWS, Azure, GCP and K8s icons
  • Snapshots of what is actually deployed, taken from terraform show -json, docker inspect or kubectl get -o json
  • SQL DDL to ER diagrams, OpenAPI/Swagger to API diagrams colored by HTTP method, GraphQL SDL to entity type diagrams
  • GitHub Actions and GitLab CI configs rendered as pipeline DAGs

For vendor icons, scripts/shapesearch.py searches an index of 10,446 real draw.io palette shapes, each with its exact style and size. The skill's shape reference tells the agent to prefer a searched style over a hand-written one.

Output options include an interactive HTML viewer with pan, zoom and search, a PowerPoint deck, animated data-flow SVG, Mermaid or Markdown export, a click-through runbook, and an exec-summary compression. Built-in style presets such as dark and corporate restyle a diagram, and bilingual label variants leave the layout untouched.

Setup gotchas

After installing the draw.io desktop app, run drawio --version to confirm the CLI is on your path. Version 29 and earlier lack both Mermaid conversion and the ELK --layout pass. On WSL2, the CLI is the Windows desktop executable, so plan for that path rather than a Linux binary.

The SKILL.md frontmatter sets disable-model-invocation: true. On hosts that honor that field, the agent will not load the skill on its own, so you need to call it explicitly. The frontmatter also requests Bash, Read, Write and WebFetch tools.

On macOS, the metadata lists optional Homebrew formulas for drawio (native exports) and graphviz (automatic layout). Without them, the core IR, XML, sync, query, test, review and Story workflows still run on Python 3 alone.

According to the install docs, the recommended installer has its own update command. SkillsMP is a listing only and does not install or update the skill, so a listing there does not mean you have the skill installed.

Security review

Broad access

This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.

  • Pre-approves broad shell commandsFrontmatter allowed-tools: [Bash, Read, Write, WebFetch] pre-approves unrestricted Bash (the same file sets disable-model-invocation: true, so it only runs when you invoke it).skills/drawio-skill/SKILL.md:6

A draw.io diagram toolkit with many local Python scripts that build, convert and export diagrams, importing from code, Terraform, Kubernetes and SQL. SKILL.md pre-approves unrestricted Bash, so the agent can run the scripts or any shell command without prompting once you invoke it. The only network traffic we found is optional icon downloads from an allowlist; diagram data placed in diagrams.net URLs stays in the URL fragment and is not sent to a server by the script.

Worth knowing

  • Makes network requests--embed in aiicons.py and dbxicons.py (line 152) downloads icon SVGs over HTTPS from an allowlist (unpkg.com, cdn.simpleicons.org, raw.githubusercontent.com, api.github.com, oieduardorabelo.github.io); diagrams may also reference remote icon URLs without --embed.skills/drawio-skill/scripts/aiicons.py:88
  • Relies on a CLI or package we could not reviewNative export needs the draw.io desktop CLI, auto-layout needs Graphviz, and live-infrastructure capture relies on terraform/docker/kubectl JSON that the user supplies; none of these programs are in the repo.skills/drawio-skill/references/security.md:17
  • Installs packages or toolsThe openclaw metadata lists optional brew installs of drawio and graphviz; the shipped GitHub Action (.github/actions/drawio-diff/action.yml line 46) apt-installs packages and a downloaded drawio .deb on a CI runner if you adopt it.skills/drawio-skill/SKILL.md:7
  • Contains compiled binariesA gzip-compressed shape index is shipped in the repo; it was not among the files we could read.skills/drawio-skill/data/shape-index.json.gz:1

What we checked

The repository (195 files) on Oct 29, 2026. Not a full review: 1 of 195 files were not downloaded (large repository; we reviewed the skill folders); it contains compiled binaries or archives we cannot read; we read 2 of 69 code files; it relies on code outside the repository: draw.io desktop CLI (jgraph/drawio-desktop) and Graphviz, called by the scripts; skills/drawio-skill/data/shape-index.json.gz (compressed data file); most of the 69 code files were pattern-scanned for network, subprocess, file-write and eval use but not read line by line; only encode_drawio_url.py and repair_png.py were read in full.

NVIDIA SkillSpector static scan: 129 pattern hits (Dangerous Code Execution 52, MCP Rug Pull 23, Rogue Agent 20, Privilege Escalation 18, Data Exfiltration 6, Tool Misuse 3). The 129 hits are mostly subprocess calls to local tools (drawio, dot, git), sudo/apt-get lines in CI docs and a GitHub Action, mkdir -p/symlink install instructions in the README, base64 used to embed icons and PNG frames as data URIs, and draw.io XML comments. skills/drawio-skill/references/security.md documents the offline-by-default behaviour and the fetch allowlist, which matched the code we checked.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT — commercial use allowed.

Can it run unattended?

Yes. CI architecture tests can run unattended on every build to catch when a diagram has drifted from the real system.

Alternatives to drawio-skill

diagram-design

cathrynlavery/diagram-design

A diagram skill that writes 45 diagram types as one self-contained HTML and SVG file in your brand, with onboarding, import and PNG export.

Recommended Check first Depth 4/5

Archify

tt-a1i/archify

A skill that turns a description or a codebase into a validated, interactive standalone HTML diagram or one-page explainer.

Recommended Check first Depth 5/5

Anatomy

wheresryan22/anatomy

Skill that builds interactive isometric SVG, WebGL and 3D figures explaining a technical idea as a working physical object, then checks its own output.

Recommended Check first Depth 5/5

Mermaid Architect (design-doc-mermaid)

SpillwaveSolutions/design-doc-mermaid

A Mermaid diagram and design-doc skill with a 23 KB router, 11 document templates, guides and scripts to validate and render diagrams with mermaid-cli.

With caveats Check first Depth 3/5

FAQ

What is drawio-skill?

drawio-skill is an agent skill that generates and maintains editable draw.io diagrams from natural language, code, infrastructure-as-code and API schemas, with sync, drift detection and CI tests.

How do I install drawio-skill?

Copy or symlink skills/drawio-skill/ so SKILL.md sits directly under your host's skills directory; cloning the whole repository root into a skills folder will not work. It needs the draw.io desktop app installed.

Does drawio-skill need draw.io installed?

Yes, for full functionality such as Mermaid conversion and the ELK layout pass, version 30 or newer is recommended. Some core workflows are offline and stdlib-only.

drawio-skill vs cathrynlavery/diagram-design?

drawio-skill targets the editable .drawio format with sync and drift testing against real system sources. diagram-design focuses on editorial-quality diagram visuals; pick based on whether you need an editable architecture model or a polished illustration.

Which agents does drawio-skill work with?

The README lists Claude Code, Cursor, Copilot, OpenClaw, Codex, Autohand Code and Hermes, plus any agent compatible with the Agent Skills format. The SKILL.md metadata lists macOS, Linux and Windows.

When should I use Mermaid or PlantUML instead of drawio-skill?

The skill's own description says to prefer Mermaid or PlantUML when diagrams-as-code is enough. Use drawio-skill when you need an editable .drawio file, draw.io/diagrams.net output, or sync and testing against real sources.

Can drawio-skill diagram infrastructure that is already deployed?

Yes. Besides reading Terraform, Kubernetes and docker-compose configs, it can snapshot live state from terraform show -json, docker inspect or kubectl get -o json, and it can produce color-coded diffs between two live snapshots.

Sources: GitHub repository (stars, license, file tree, last push Oct 11, 2026). Review based on the README and SKILL.md files as published.