Use when creating a draw.io diagram for POA&M items, audit findings, remediation milestones, validation, closure, and escalation paths in a GRC, security, audit, compliance, privacy, cloud, or risk context.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 9 of 22 test cases with the skill, and 13 of 22 without it.
Without skill57%
With skill43%
Checks it passed that the model alone missed
The filename uses descriptive lowercase hyphenated words.
Automated collectors, platforms, and databases are styled using blue fills.
Manual tasks, external parties, or out-of-scope elements are styled with gray fill colors.
3 fixed9 passed either way6 still failing4 broke
Pass-rate lift
-14 pp
Tokens
+25%
Agent turns
0%
Response time
+3%
Model gemini-3.6-flashMeasured 8/23/2026v112 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 3
Prompt
When saving the generated draw.io diagram file for a FedRAMP High quarterly POA&M review, what exact filename convention should be used for the output file?
What was checked, without and with the skill
Checked
Without skill
With skill
The filename uses descriptive lowercase hyphenated words.
Missed
Passed
case-15 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md60 linessingle file
GRC POA&M lifecycle diagram
Use this skill to structure the GRC content and visual pattern for POA&M items, audit findings, remediation milestones, validation, closure, and escalation paths. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
FedRAMP POA&M lifecycle
audit finding remediation
vulnerability exception to POA&M
corrective action tracking
Recommended Elements
Include these when relevant:
finding
POA&M item
owner
severity
milestone
due date
validation
closure
risk acceptance
Recommended Output Pattern
Produce a State machine, remediation workflow, or milestone timeline. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.