Use when creating a draw.io diagram for audit planning, request lists, evidence, testing, exceptions, remediation, and reporting in a GRC, security, audit, compliance, privacy, cloud, or risk context.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 8 of 22 test cases with the skill, and 13 of 22 without it.
Without skill59%
With skill35%
Checks it passed that the model alone missed
Output uses a lowercase hyphenated filename.
Output applies gray fill styling to manual steps.
Output applies blue fill styling to automated collectors.
and 3 more in the full report
3 fixed1 passed either way13 still failing5 broke
Pass-rate lift
-24 pp
Tokens
+70%
Agent turns
0%
Response time
+50%
Model gemini-3.6-flashMeasured 8/23/2026v14 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
Construct an enterprise audit boundary process map illustrating systems inside the HIPAA authorization boundary versus out-of-scope third-party services.
What was checked, without and with the skill
Checked
Without skill
With skill
Output places in-scope systems inside dashed container boxes.
Missed
Passed
Output applies gray fill styling to out-of-scope third-party services.
Missed
Passed
case-12 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md61 linessingle file
GRC audit workflow diagram
Use this skill to structure the GRC content and visual pattern for audit planning, request lists, evidence, testing, exceptions, remediation, and reporting. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
SOC 2 audit timeline
internal audit workflow
external auditor request lifecycle
control testing process
Recommended Elements
Include these when relevant:
auditor
GRC
control owner
engineering
request list
evidence
testing
exception
remediation
report
Recommended Output Pattern
Produce a Swimlane process map or audit timeline. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.