Use when creating a draw.io diagram for compliance scope, authorization boundaries, trust boundaries, in-scope/out-of-scope systems, and system context diagrams in a GRC, security, audit, compliance, privacy, cloud, or risk context.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 8 of 20 test cases with the skill, and 13 of 20 without it.
Without skill63%
With skill38%
Checks it passed that the model alone missed
The generated filename uses lowercase hyphenated naming conventions.
The unencrypted S3 bucket risk nodes are assigned red visual styling.
The manual exception path is represented using dotted edge connections.
and 1 more in the full report
4 fixed11 passed either way4 still failing3 broke
Pass-rate lift
-25 pp
Tokens
+44%
Agent turns
0%
Response time
+28%
Model gemini-3.6-flashMeasured 8/23/2026v115 of 22 cases passed with skill · 20 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
Generate an export file specification and draw.io XML diagram for a FedRAMP Moderate boundary mapping core container clusters. What filename pattern should be used for the output file?
What was checked, without and with the skill
Checked
Without skill
With skill
The generated filename uses lowercase hyphenated naming conventions.
Missed
Passed
case-10 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md60 linessingle file
GRC system boundary diagram
Use this skill to structure the GRC content and visual pattern for compliance scope, authorization boundaries, trust boundaries, in-scope/out-of-scope systems, and system context diagrams. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
FedRAMP authorization boundary
SOC 2 system boundary
PCI CDE boundary
HIPAA ePHI boundary
Recommended Elements
Include these when relevant:
systems
actors
identity providers
data stores
monitoring
boundaries
inherited services
exclusions
control overlays
Recommended Output Pattern
Produce a Architecture boundary diagram, trust-zone diagram, or system context diagram. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.