drawio-azure

drawio-azure is a skill for Claude Code, Codex from ihatesea69/kiro-kit. It costs 89 tokens per session (1,535 once invoked), scanned A, a copy of drawio-aws, MIT.

A guide for turning verified security-scan results into a findings workspace containing a main report, individual finding reports, recommendations, and machine-readable files.

In plain words
What is it for?
Use it at the end of a deep security scan to publish findings, severity counts, coverage details, and hardening recommendations.
Why use it?
It gives people and CI systems a consistent record of what the security scan accepted and how much of the repository it covered.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions subagents; mentions Claude Code.

Good fit Use it at the end of a deep security scan to publish findings, severity counts, coverage details, and hardening recommendations.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/ihatesea69/kiro-kit/drawio-azure
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add ihatesea69/kiro-kit --skill drawio-azure
Clone the repo
git clone --depth 1 https://github.com/ihatesea69/kiro-kit

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for drawio-azure

README.md
[![agentmods](https://agentmods.dev/badge/skills/ihatesea69/kiro-kit/drawio-azure.svg)](https://agentmods.dev/skills/ihatesea69/kiro-kit/drawio-azure)
Your own site
<a href="https://agentmods.dev/skills/ihatesea69/kiro-kit/drawio-azure"><img src="https://agentmods.dev/badge/skills/ihatesea69/kiro-kit/drawio-azure.svg" alt="Measured on agentmods" height="20"></a>
Per session 89 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,535 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 89% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00089 $0.01535
Opus 5 $0.00044 $0.00767
Sonnet 5 $0.00018 $0.00307
Haiku 4.5 $0.00009 $0.00153

Measured 4d ago against content hash 24d85a8eacae, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

drawio-azure scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

89% identical to drawio-aws — 24 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

presets/sa/skills/drawio-azure/SKILL.md · 133 lines

How it starts

The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Draw.io Azure

Produce correct Azure architecture diagrams in draw.io. This skill is a thin frontend; the deterministic engine, validator, and rules live in the drawio-ai-kit package, reached via the drawio-ai CLI.

0. Preflight — the CLI must be installed

command -v drawio-ai >/dev/null 2>&1 || echo "Install the Kit first:  npm i -g github:sparklabx/drawio-ai-kit"

If drawio-ai is not on PATH, stop and tell the user to run npm i -g github:sparklabx/drawio-ai-kit. Never run npm i -g yourself — nothing mutates the user's global environment without their say-so.

1. Delegate the build (preferred when your harness supports it)

If your harness can spawn autonomous subagents that run shell commands AND read images (e.g. Claude Code's Task tool, a general-purpose agent), run the whole build loop in a subagent — the rules, icon searches, and every render/fix iteration then cost this conversation nothing. If it can't (or the subagent can't read images), skip to Inline path below — same loop, same rules.

Before spawning, resolve what the subagent cannot ask about: diagram scope, output directory (absolute path under the user's project), filename. Run the preflight above yourself. For a multi-diagram request, spawn one subagent per diagram in parallel with distinct filenames.

Model routing — if your harness lets you choose the subagent's model, route by task weight: a fast/cheap tier (Claude Haiku-class — must support vision) when the request matches a template from the rules' Templates table (reproduction is mechanical; the validator's advice strings teach every fix), your default strong model for free-hand or novel architectures. If a cheap subagent returns VALIDATE not ok or ITERATIONS > 3, respawn ONCE on the strong model before taking over inline. Multi-diagram requests: route each diagram independently.

Subagent prompt (fill every <...>):

Build an Azure architecture .drawio diagram with the drawio-ai CLI.
Request: <user's request + clarifications, verbatim>
Output: <ABS_PROJECT_DIR>/<NAME>.drawio — never write inside the Kit, never into cwd.
Follow exactly:
1. Set ROOT="$(drawio-ai root)". Read $ROOT/docs/api-cheatsheet.md — the full layout-engine
   API in one file; never read library source.
2. Run `drawio-ai workflow` and `drawio-ai principles --mode azure` — the source of
   truth. (Fallback if a command is blocked: read $ROOT/rules/*.md directly.)
3. Look up every icon with ONE batched `drawio-ai search "a, b, c"`; never recolor icons.
4. Scaffold, don't write: `drawio-ai scaffold --list`, pick the closest template, then
   `drawio-ai scaffold <name>.mjs -o <dir>/build.mjs` — the script arrives runnable
   (absolute imports, self-validating, self-rendering with an issues list). Edit only the
   deltas. If no template is close AND you'd change more than half of it, Write a new
   script instead (keep the scaffold's self-check tail). Layout engine only
   (group/frame/grid/icon/box + renderTree), NO hand-written coordinates.
5. Each `node build.mjs` run prints validate JSON AND the render's machine-readable
   `issues` list. Fix from THAT checklist — all issues in one Edit round — then re-run.
   Loop until issues is empty.
6. Only when issues is empty: Read the PNG once as final visual confirmation (list any
   remaining visual problems, fix ALL in one round). Target <= 2 PNG reads total. Then
   render once WITHOUT --check for the final deliverable PNG.
Do NOT invoke any drawio skill — this prompt already contains the full procedure.
Do not ask questions — make the standard choice and record it under ASSUMPTIONS.
Return EXACTLY this block, nothing else:
DRAWIO: <absolute path to .drawio>
PNG: <absolute path to .png>
VALIDATE: <verbatim final validate JSON>
ICONS: <comma-separated icon names used>
ITERATIONS: <number of render/fix cycles>
SUMMARY: <one sentence describing the diagram>
ASSUMPTIONS: <choices made without asking, or "none">

Read the full file on GitHub · 133 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 133 lines · 89 tokens per session scan A 24d85a8eacae

Subscribe to this mod's changes

drawio-azure is a skill published in the GitHub repository ihatesea69/kiro-kit (18 stars, last pushed 19d ago), licensed MIT. It adds 89 tokens to every session and 1,535 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. It is 89% identical to drawio-aws, differing in 24 lines, and is treated as a copy.