Use when creating a draw.io diagram for mapping controls and obligations across frameworks to show overlap, gaps, and conflicts in a GRC, security, audit, compliance, privacy, cloud, or risk context.
SkillScore53Maintained
Automatic
◆Security & AppSec pack
Last verified 8/24/2026
What it changes
Passed 12 of 22 test cases with the skill, and 9 of 22 without it.
Without skill40%
With skill53%
Checks it passed that the model alone missed
Output includes business impact labels.
Output specifies a lowercase hyphenated filename.
Output uses blue visual elements for automated collectors.
and 6 more in the full report
7 fixed3 passed either way8 still failing4 broke
Pass-rate lift
+13 pp
Tokens
+68%
Agent turns
0%
Response time
+48%
Model gemini-3.6-flashMeasured 8/24/2026v110 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 7
Prompt
We need a draw.io visual mapping NIST CSF 2.0 to CIS Controls v8. Should we output this as a Mermaid diagram block in the final step?
What was checked, without and with the skill
Checked
Without skill
With skill
Output generates native mxGraphModel XML directly rather than Mermaid diagram syntax.
Missed
Passed
case-20 · gemini-3.6-flash · 8/24/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md56 linessingle file
GRC framework crosswalk diagram
Use this skill to structure the GRC content and visual pattern for mapping controls and obligations across frameworks to show overlap, gaps, and conflicts. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
SOC 2 to ISO 27001 to NIST CSF
FedRAMP to NIST 800-53
CIS to SOC 2
Recommended Elements
Include these when relevant:
source framework
normalized control
target framework
one-to-one/one-to-many/partial/no-match
gaps
conflicts
Recommended Output Pattern
Produce a Crosswalk matrix, many-to-many map, or common-control cluster. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.
Validate XML well-formedness before finalizing.
If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.