Use when creating a draw.io diagram for regulated data flows, data classifications, storage, processing, transfer, access, retention, and logging in a GRC, security, audit, compliance, privacy, cloud, or risk context.
SkillScore59Maintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 13 of 22 test cases with the skill, and 12 of 22 without it.
Without skill55%
With skill59%
Checks it passed that the model alone missed
Generates native mxGraphModel XML markup.
Specifies data retention duration on persistent storage nodes.
Uses a lowercase hyphenated filename for the output diagram file.
and 2 more in the full report
4 fixed9 passed either way6 still failing3 broke
Pass-rate lift
+5 pp
Tokens
+39%
Agent turns
0%
Response time
+23%
Model gemini-3.6-flashMeasured 8/23/2026v113 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 4
Prompt
We are designing a diagram for our cloud data pipeline (AWS Lambda, S3 ingestion bucket, and PostgreSQL database). Base models often color database servers green or orange. Please output an editable diagram XML where core cloud systems and platform services follow standard GRC visual color conventions.
What was checked, without and with the skill
Checked
Without skill
With skill
Applies blue visual styling to automated cloud services and database systems.
Missed
Passed
case-09 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md61 linessingle file
GRC regulated data flow diagram
Use this skill to structure the GRC content and visual pattern for regulated data flows, data classifications, storage, processing, transfer, access, retention, and logging. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
customer data through SaaS
HIPAA ePHI flow
CMMC/FedRAMP CUI flow
PCI CHD flow
Recommended Elements
Include these when relevant:
actors
data classes
systems
stores
flows
boundaries
retention
encryption
access
logging
Recommended Output Pattern
Produce a Data flow diagram with trust-boundary and classification overlays. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.