Use when creating a draw.io diagram for controls mapped across frameworks, systems, owners, risks, and evidence sources in a GRC, security, audit, compliance, privacy, cloud, or risk context.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 6 of 22 test cases with the skill, and 6 of 22 without it.
Without skill27%
With skill27%
Checks it passed that the model alone missed
The response outputs native mxGraphModel XML syntax.
The output provides native mxGraphModel XML instead of Mermaid code.
The diagram illustrates operational failure paths or automated collectors.
and 3 more in the full report
5 fixed1 passed either way11 still failing5 broke
Pass-rate lift
0 pp
Tokens
+31%
Agent turns
0%
Response time
+19%
Model gemini-3.6-flashMeasured 8/23/2026v16 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
Please generate a draw.io architecture file mapping CIS Controls v8 to our Azure infrastructure for our Chief Information Security Officer. Focus on high-level capability status.
What was checked, without and with the skill
Checked
Without skill
With skill
The diagram layout presents a compact capability view tailored for executive review.
Passed
Passed
The response outputs native mxGraphModel XML syntax.
Missed
Passed
case-04 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md58 linessingle file
GRC control map diagram
Use this skill to structure the GRC content and visual pattern for controls mapped across frameworks, systems, owners, risks, and evidence sources. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
SOC 2 CC6.1 to AWS IAM/Okta/GitHub
NIST AC to ISO Annex A
common control implementation
Recommended Elements
Include these when relevant:
controls
frameworks
systems
owners
evidence
risks
inherited controls
implementation status
Recommended Output Pattern
Produce a Hub-and-spoke control map or control coverage diagram. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.
Validate XML well-formedness before finalizing.
If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.