drawio-mcp-diagramming

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the official Draw.io MCP infrastructure, including a hosted server at https://mcp.draw.io/mcp and the @drawio/mcp package from the npm registry. As Draw.io is a well-known technology service, these references are documented as part of the intended integration.
  • [COMMAND_EXECUTION]: The skill configuration utilizes npx to launch the local Draw.io MCP server (@drawio/mcp). This is a standard execution pattern for MCP-based tools and is scoped to the diagramming functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill serves as a generator for structured diagramming code based on user requests. It includes extensive architectural guardrails, authoring rules, and layout anti-pattern references to ensure that the generated output is safe, well-formed, and properly contained within the Draw.io XML schema.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 04:44 PM