Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sparklabx/drawio-ai-kit --skill drawio-awsgit clone --depth 1 https://github.com/sparklabx/drawio-ai-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sparklabx/drawio-ai-kit/drawio-aws)<a href="https://agentmods.dev/skills/sparklabx/drawio-ai-kit/drawio-aws"><img src="https://agentmods.dev/badge/skills/sparklabx/drawio-ai-kit/drawio-aws.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 129 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
- medium Excessive Agency · line 79 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.01560 |
| Opus 5 | $0.00047 | $0.00780 |
| Sonnet 5 | $0.00019 | $0.00312 |
| Haiku 4.5 | $0.00009 | $0.00156 |
Grade A, and why
drawio-aws scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
6 near-identical copies found in the catalogue:
- drawio-aws — 100% identical, 0 lines differ
- drawio-azure — 89% identical, 24 lines differ
- drawio-azure — 89% identical, 24 lines differ
- drawio-gcp — 81% identical, 24 lines differ
- drawio-gcp — 81% identical, 24 lines differ
- drawio-bpmn — 75% identical, 38 lines differ
How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Draw.io AWS
Produce correct AWS architecture diagrams in draw.io. This skill is a thin
frontend; the deterministic engine, validator, and rules live in the
drawio-ai-kit package, reached via the drawio-ai CLI.
0. Preflight — the CLI must be installed
command -v drawio-ai >/dev/null 2>&1 || echo "Install the Kit first: npm i -g github:sparklabx/drawio-ai-kit"
If drawio-ai is not on PATH, stop and tell the user to run
npm i -g github:sparklabx/drawio-ai-kit. Never run npm i -g yourself — nothing mutates the
user's global environment without their say-so.
1. Delegate the build (preferred when your harness supports it)
If your harness can spawn autonomous subagents that run shell commands AND read images (e.g. Claude Code's Task tool, a general-purpose agent), run the whole build loop in a subagent — the rules, icon searches, and every render/fix iteration then cost this conversation nothing. If it can't (or the subagent can't read images), skip to Inline path below — same loop, same rules.
Before spawning, resolve what the subagent cannot ask about: diagram scope, output directory (absolute path under the user's project), filename. Run the preflight above yourself. For a multi-diagram request, spawn one subagent per diagram in parallel with distinct filenames.
Model routing — if your harness lets you choose the subagent's model, route by task weight: a fast/cheap tier (Claude Haiku-class — must support vision) when the request matches a template from the rules' Templates table (reproduction is mechanical; the validator's advice strings teach every fix), your default strong model for free-hand or novel architectures. If a cheap subagent returns VALIDATE not ok or ITERATIONS > 3, respawn ONCE on the strong model before taking over inline. Multi-diagram requests: route each diagram independently.
Subagent prompt (fill every <...>):
Build an AWS architecture .drawio diagram with the drawio-ai CLI.
Request: <user's request + clarifications, verbatim>
Output: <ABS_PROJECT_DIR>/<NAME>.drawio — never write inside the Kit, never into cwd.
Follow exactly:
1. Set ROOT="$(drawio-ai root)". Read $ROOT/docs/api-cheatsheet.md — the full layout-engine
API in one file; never read library source.
2. Run `drawio-ai workflow` and `drawio-ai principles --mode aws` — the source of
truth. (Fallback if a command is blocked: read $ROOT/rules/*.md directly.)
3. Look up every icon with ONE batched `drawio-ai search "a, b, c"`; never recolor icons.
4. Scaffold, don't write: `drawio-ai scaffold --list`, pick the closest template, then
`drawio-ai scaffold <name>.mjs -o <dir>/build.mjs` — the script arrives runnable
(absolute imports, self-validating, self-rendering with an issues list). Edit only the
deltas. If no template is close AND you'd change more than half of it, Write a new
script instead (keep the scaffold's self-check tail). Layout engine only
(group/frame/grid/icon/box + renderTree), NO hand-written coordinates.
5. Each `node build.mjs` run prints validate JSON AND the render's machine-readable
`issues` list. Fix from THAT checklist — all issues in one Edit round — then re-run.
Loop until issues is empty.
6. Only when issues is empty: Read the PNG once as final visual confirmation (list any
remaining visual problems, fix ALL in one round). Target <= 2 PNG reads total. Then
render once WITHOUT --check for the final deliverable PNG.
Do NOT invoke any drawio skill — this prompt already contains the full procedure.
Do not ask questions — make the standard choice and record it under ASSUMPTIONS.
Return EXACTLY this block, nothing else:
DRAWIO: <absolute path to .drawio>
PNG: <absolute path to .png>
VALIDATE: <verbatim final validate JSON>
ICONS: <comma-separated icon names used>
ITERATIONS: <number of render/fix cycles>
SUMMARY: <one sentence describing the diagram>
ASSUMPTIONS: <choices made without asking, or "none">
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 133 lines · 94 tokens per session scan A 49cc10497993
drawio-aws is a skill published in the GitHub repository sparklabx/drawio-ai-kit (638 stars, last pushed 27d ago), licensed MIT. It adds 94 tokens to every session and 1,560 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
drawio-aws-reference
Produce AWS architecture diagrams as editable .drawio files using the AWS 2026 shape set (mxgraph.aws4 stencils), with verified stencil names and a validator. Use this whenever an AWS architecture diagram is requested, revised, or reviewed, including when the user only says "draw the architecture", "diagram this"…
architecture-diagrams
Turn a natural-language cloud architecture description into an editable diagram whose nodes are official vendor service icons (Azure, AWS, GCP, Kubernetes), exported as PDF, draw.io, or VSDX (Lucid-importable). Use when the user asks to draw, diagram, or visualize a cloud/system architecture, or to produce a…
aws-architecture-diagram
Generate validated AWS architecture diagrams as draw.io XML using official AWS4 icon libraries. Use this skill whenever the user wants to create, generate, or design AWS architecture diagrams, cloud infrastructure diagrams, or system design visuals. Also triggers for requests to visualize existing infrastructure from…
ovh
OVHcloud infrastructure integration for managing instances, Kubernetes clusters, networks, and object storage via CLI and Terraform.
scaleway
Scaleway cloud integration for managing instances, Kapsule Kubernetes clusters, object storage, and managed databases via CLI and Terraform.
isaac-automator
Deploy and operate a cloud Isaac Workstation with Isaac Automator: provision a GPU VM running Isaac Sim, Isaac Lab, and/or Isaac Lab Arena on AWS, GCP, Azure, or Alibaba Cloud, connect to it, move data in and out, control cost with stop/start, repair, import existing deployments, and destroy. Use when the user wants a…