Use when creating a draw.io diagram for vendor intake, tiering, questionnaires, security/privacy/legal review, contracting, and ongoing monitoring in a GRC, security, audit, compliance, privacy, cloud, or risk context.
SkillScore64Maintained
Automatic
◆Security & AppSec pack
Last verified 8/23/2026
What it changes
Passed 14 of 22 test cases with the skill, and 12 of 22 without it.
Without skill55%
With skill64%
Checks it passed that the model alone missed
Exception or escalation connections use dotted edge styling.
Manual tasks or external party elements are styled with a gray color.
The final artifact is native mxGraphModel XML rather than Mermaid syntax.
and 1 more in the full report
4 fixed10 passed either way6 still failing2 broke
Pass-rate lift
+9 pp
Tokens
+50%
Agent turns
0%
Response time
+28%
Model gemini-3.6-flashMeasured 8/23/2026v114 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 4
Prompt
In our vendor onboarding diagram in draw.io format, we want to visually differentiate between approved compliant outcomes and external vendor manual inputs. What visual fill color conventions should be applied to these two distinct box types?
What was checked, without and with the skill
Checked
Without skill
With skill
Approved compliant outcome elements are styled with a green color.
Passed
Passed
Manual tasks or external party elements are styled with a gray color.
Missed
Passed
case-05 · gemini-3.6-flash · 8/23/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md61 linessingle file
GRC third-party risk diagram
Use this skill to structure the GRC content and visual pattern for vendor intake, tiering, questionnaires, security/privacy/legal review, contracting, and ongoing monitoring. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
new vendor intake
security questionnaire workflow
vendor tiering
DPIA handoff
continuous vendor monitoring
Recommended Elements
Include these when relevant:
business owner
procurement
legal
privacy
security
vendor
approver
artifacts
tiering decisions
Recommended Output Pattern
Produce a Vendor lifecycle, swimlane workflow, or tiering decision tree. Choose a layout that matches the audience:
Executive: compact lifecycle/capability view with business impact labels.
Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
Load and follow the drawio skill.
Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
Use descriptive lowercase hyphenated filenames.
Include a legend when colors, edge styles, or containers have compliance meaning.