Use when creating a draw.io diagram for risk intake, scoring, treatment, exception approval, residual risk, and monitoring workflows in a GRC, security, audit, compliance, privacy, cloud, or risk context.
SkillScore74Maintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 17 of 23 test cases with the skill, and 13 of 23 without it.
Without skill57%
With skill74%
Checks it passed that the model alone missed
The response does not use Mermaid code syntax.
The output contains native mxGraphModel XML markup.
Dashed containers are used to group scope boundaries.
and 4 more in the full report
6 fixed11 passed either way4 still failing2 broke
Pass-rate lift
+17 pp
Tokens
+76%
Agent turns
0%
Response time
+40%
Model gemini-3.6-flashMeasured 8/23/2026v117 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
I need an editable diagram that maps out our vulnerability management pipeline. It should show the full path from initial automated scanner findings through risk scoring, assigning a remediation owner, tracking exception requests if patching isn't feasible, and ongoing monitoring. Please format this as a clear visual workflow suitable for our engineering and security teams.
What was checked, without and with the skill
Checked
Without skill
With skill
The output contains native mxGraphModel XML markup.
Missed
Passed
The response does not use Mermaid code syntax.
Missed
Passed
case-01 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md59 linessingle file
GRC risk treatment diagram
Use this skill to structure the GRC content and visual pattern for risk intake, scoring, treatment, exception approval, residual risk, and monitoring workflows. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
risk register lifecycle
vulnerability-to-risk workflow
vendor risk acceptance
policy exception approval
Recommended Elements
Include these when relevant:
risk source
assessment
inherent/residual score
treatment choice
owner
approver
due date
monitoring
Recommended Output Pattern
Produce a Decision tree or risk treatment lifecycle. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.
Validate XML well-formedness before finalizing.
If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.