drawio-mcp-diagramming
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Draw.io MCP infrastructure, including a hosted server at
https://mcp.draw.io/mcpand the@drawio/mcppackage from the npm registry. As Draw.io is a well-known technology service, these references are documented as part of the intended integration. - [COMMAND_EXECUTION]: The skill configuration utilizes
npxto launch the local Draw.io MCP server (@drawio/mcp). This is a standard execution pattern for MCP-based tools and is scoped to the diagramming functionality. - [INDIRECT_PROMPT_INJECTION]: The skill serves as a generator for structured diagramming code based on user requests. It includes extensive architectural guardrails, authoring rules, and layout anti-pattern references to ensure that the generated output is safe, well-formed, and properly contained within the Draw.io XML schema.
Audit Metadata